Add workflow-wide gh actions permissions (#1187)

Co-authored-by: Maksim Stepanov <[email protected]>

Author: epszaw

.github/workflows/labeler.yml

@@ -3,9 +3,14 @@ name: "Set theme labels"
 on:
   - pull_request_target
 
+permissions:
+  contents: read 
+
 jobs:
   triage:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
     steps:
       - uses: actions/labeler@v4
         with:

.github/workflows/labels-verify.yml

@@ -4,9 +4,14 @@ on:
   pull_request_target:
     types: [opened, labeled, unlabeled, synchronize]
 
+permissions:
+  contents: none 
+
 jobs:
   triage:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
     steps:
       - uses: baev/action-label-verify@main
         with:

.github/workflows/publish.yml

@@ -4,6 +4,9 @@ on:
   release:
     types: [ published ]
 
+permissions:
+  contents: read 
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -11,9 +11,14 @@ on:
         description: "The next version in <MAJOR>.<MINOR> format WITHOUT SNAPSHOT SUFFIX"
         required: true
 
+permissions:
+  contents: read 
+
 jobs:
   triage:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: "Check release version"
         run: |