Set permissions for Github Actions

Author: dolfinus

.github/workflows/automerge.yml

@@ -9,6 +9,10 @@ jobs:
         runs-on: ubuntu-latest
         if: github.event.pull_request.user.login == 'pre-commit-ci[bot]' || github.event.pull_request.user.login == 'dependabot[bot]'
 
+        permissions:
+            contents: read
+            pull-requests: write
+
         steps:
             - uses: alexwilson/[email protected]
               with:
@@ -21,6 +25,10 @@ jobs:
         runs-on: ubuntu-latest
         if: github.event.pull_request.user.login == 'pre-commit-ci[bot]' || github.event.pull_request.user.login == 'dependabot[bot]'
 
+        permissions:
+            contents: read
+            pull-requests: write
+
         steps:
             - uses: hmarr/auto-approve-action@v4
               with:

.github/workflows/linters.yml

@@ -16,6 +16,10 @@ concurrency:
 jobs:
   linters:
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/repo-labels-sync.yml

@@ -16,6 +16,12 @@ on:
 jobs:
     labeler:
         runs-on: ubuntu-latest
+
+        permissions:
+            contents: read
+            issues: write # to update repo labels
+            pull-requests: write # to update repo labels
+
         steps:
             - name: Checkout
               uses: actions/checkout@v4