apply best practices

Signed-off-by: Carlos Panato <[email protected]>

Author: cpanato

.github/workflows/compute_slsa_source.yml

@@ -3,12 +3,16 @@ name: "Computes the SLSA source information"
 on:
   workflow_call:
 
+permissions: {}
+
 jobs:
   compute_slsa_source:
+    runs-on: ubuntu-latest
+
     permissions:
       contents: write # needed for storing attestations in the repo
       id-token: write
-    runs-on: ubuntu-latest
+
     steps:
     - name: prov
       uses: slsa-framework/slsa-source-poc/actions/slsa_with_provenance@main

.github/workflows/local_attest.yml

@@ -4,8 +4,12 @@
 name: SLSA Source
 on:
   push:
-    branches: [ "main" ]
-    tags: ['**']
+    branches:
+      - main
+    tags:
+      - '**'
+
+permissions: {}
 
 jobs:
   # Whenever new source is pushed recompute the slsa source information.