ci: scopedown GitHub token

.github/workflows/auto_assign.yml

@@ -3,6 +3,10 @@ on:
   pull_request:
     types: [opened, ready_for_review]
 
+
+permissions:
+  pull-requests: write
+
 jobs:
   add-reviews:
     runs-on: ubuntu-latest

.github/workflows/build.yml

@@ -6,6 +6,10 @@ on:
   pull_request:
     branches: [ develop, main ]
 
+
+permissions:
+  contents: read
+
 defaults:
   run:
     working-directory: ./

.github/workflows/label_pr_on_title.yml

@@ -6,6 +6,11 @@ on:
     types:
       - completed
 
+
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   get_pr_details:
     # Guardrails to only ever run if PR recording workflow was indeed

.github/workflows/on_merged_pr.yml

@@ -6,6 +6,11 @@ on:
     types:
       - completed
 
+
+permissions:
+  contents: read
+  issues: write
+
 jobs:
   get_pr_details:
     if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success'

.github/workflows/on_opened_pr.yml

@@ -6,6 +6,11 @@ on:
     types:
       - completed
 
+
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   get_pr_details:
     if: ${{ github.event.workflow_run.conclusion == 'success' }}

.github/workflows/record_pr.yml

@@ -4,6 +4,10 @@ on:
   pull_request:
     types: [opened, edited, closed]
 
+
+permissions:
+  contents: read
+
 jobs:
   record_pr:
     runs-on: ubuntu-latest

.github/workflows/reusable_export_pr_details.yml

@@ -36,6 +36,10 @@ on:
         description: "Whether PR is merged"
         value: ${{ jobs.export_pr_details.outputs.prIsMerged }}
 
+
+permissions:
+  contents: read
+
 jobs:
   export_pr_details: