fix(snapcraft): set confinement to strict by default

internal/pipe/snapcraft/snapcraft.go

@@ -126,6 +126,9 @@ func (Pipe) Default(ctx *context.Context) error {
 		if snap.Grade == "" {
 			snap.Grade = "stable"
 		}
+		if snap.Confinement == "" {
+			snap.Confinement = "strict"
+		}
 		if len(snap.ChannelTemplates) == 0 {
 			switch snap.Grade {
 			case "devel":

internal/pipe/snapcraft/snapcraft_test.go

@@ -494,6 +494,7 @@ func TestDefault(t *testing.T) {
 	require.Equal(t, []string{"foo"}, ctx.Config.Snapcrafts[0].Builds)
 	require.Equal(t, []string{"edge", "beta", "candidate", "stable"}, ctx.Config.Snapcrafts[0].ChannelTemplates)
 	require.Equal(t, "stable", ctx.Config.Snapcrafts[0].Grade)
+	require.Equal(t, "strict", ctx.Config.Snapcrafts[0].Confinement)
 }
 
 func TestDefaultGradeTmpl(t *testing.T) {

www/docs/customization/snapcraft.md

@@ -91,6 +91,8 @@ snapcrafts:
     # `devel` will let you release only to the `edge` and `beta` channels in the
     # store. `stable` will let you release also to the `candidate` and `stable`
     # channels.
+    #
+    # Default: 'stable'
     grade: stable
 
     # Snaps can be setup to follow three different confinement policies:
@@ -99,6 +101,8 @@ snapcrafts:
     # permissions for strict snaps can be declared as `plugs` for the app, which
     # are explained later. More info about confinement here:
     # https://snapcraft.io/docs/reference/confinement
+    #
+    # Default: 'strict'
     confinement: strict
 
     # Your app's license, based on SPDX license expressions: