Add explicit permissions for GitHub workflows and update CODEOWNERS

.github/CODEOWNERS

@@ -1,38 +1,21 @@
-# This is a comment.
-# Each line is a file pattern followed by one or more owners.
-
-# These owners will be the default owners for everything in the repo.
-# Unless a later match takes precedence, @global-owner1 and @global-owner2
-# will be requested for review when someone opens a pull request.
-# *       @global-owner1 @global-owner2
-
-# Order is important; the last matching pattern takes the most precedence.
-# When someone opens a pull request that only modifies JS files, only @js-owner
-# and not the global owner(s) will be requested for a review.
-# *.js    @js-owner
-
-# You can also use email addresses if you prefer. They'll be used to look up
-# users just like we do for commit author emails.
-# docs/*  docs@example.com
+####################
+# Global  defaults #
+####################
 
 * @lesserwhirls
 
 #####################
 # top level modules #
 #####################
 
-httpservices/** @DennisHeimbigner @lesserwhirls
-netcdf4/** @DennisHeimbigner @lesserwhirls
+# None at this time
 
 ###########################################
 # classpath / not module specific matches #
 ###########################################
 
 **/iosp/nids/** @dopplershift @lesserwhirls
 
-**/opendap/** @DennisHeimbigner @lesserwhirls
-**/dap4/** @DennisHeimbigner @lesserwhirls
-
 ######################
 # general file types #
 ######################
@@ -43,3 +26,5 @@ netcdf4/** @DennisHeimbigner @lesserwhirls
 ####################
 # individual files #
 ####################
+
+# None at this time

.github/workflows/deps.yml

@@ -1,4 +1,8 @@
-on: [pull_request]
+on:
+  pull_request:
+
+permissions:
+  contents: read
 
 jobs:
   check-dependency-availability:

.github/workflows/docs-tutorials.yml

@@ -1,6 +1,9 @@
 on:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   check-doc-build:
     name: netCDF-Java Documentation Code Deprecation Check

.github/workflows/docs.yml

@@ -5,6 +5,9 @@ on:
       - 'docs/build.gradle'
       - 'gradle/**'
 
+permissions:
+  contents: read
+
 jobs:
   check-doc-build:
     name: netCDF-Java Documentation Build Check

.github/workflows/libaec.yml

@@ -13,6 +13,9 @@ name: libaec build using CMake on multiple platforms
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     strategy:

.github/workflows/libblosc2.yml

@@ -3,6 +3,9 @@ name: C-Blosc2 build using CMake on multiple platforms
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     strategy:

.github/workflows/style.yml

@@ -1,4 +1,8 @@
-on: [pull_request]
+on:
+  pull_request:
+
+permissions:
+  contents: read
 
 jobs:
   check-style:

.github/workflows/test-native-compression.yml

@@ -7,6 +7,9 @@ on:
       - 'native-compression/build.gradle'
       - '.github/workflows/test-native-compression.yml'
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     strategy:

.github/workflows/tests.yml

@@ -1,4 +1,8 @@
-on: [pull_request]
+on:
+  pull_request:
+
+permissions:
+  contents: read
 
 jobs:
   netcdf-java-tests: