chore: Add permissions to all workflows (#2289)

Author: erezrokah

.github/workflows/add_tags.yml

@@ -5,6 +5,9 @@ on:
     types: [opened, reopened]
     paths:
       - 'go.mod'
+permissions:
+  contents: read
+
 jobs:
   go-mod-tidy-example:
     timeout-minutes: 5

.github/workflows/go_mod_tidy_examples.yml

@@ -7,6 +7,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   golangci:
     name: Lint with GolangCI

.github/workflows/lint_golang.yml

@@ -6,6 +6,9 @@ on:
       - ".github/workflow/lint_markdown.yml"
       - "**.md"
 
+permissions:
+  contents: read
+
 jobs:
   lint-grammar:
     runs-on: ubuntu-latest

.github/workflows/lint_markdown.yml

@@ -7,6 +7,9 @@ on:
       - edited
       - synchronize
 
+permissions:
+  pull-requests: read
+
 jobs:
   main:
     name: Validate PR title
@@ -45,7 +48,7 @@ jobs:
           # special "[WIP]" prefix to indicate this state. This will avoid the
           # validation of the PR title and the pull request checks remain pending.
           # Note that a second check will be reported if this is enabled.
-          wip: true
+          wip: false
           # When using "Squash and merge" on a PR with only one commit, GitHub
           # will suggest using that commit message instead of the PR title for the
           # merge commit, and it's easy to commit this by mistake. Enable this option

.github/workflows/pr_title.yml

@@ -4,6 +4,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   release-please:
     runs-on: ubuntu-latest

.github/workflows/release-pr.yml

@@ -6,6 +6,9 @@ on:
     types:
       - completed
 
+permissions:
+  contents: read
+
 jobs:
   post-unitests:
     runs-on: ubuntu-latest

.github/workflows/unittest-post.yml

@@ -7,6 +7,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   unitests:
     strategy:
@@ -37,6 +40,7 @@ jobs:
         with:
           name: delta-action-benchmarks
           retention-days: 7
+          if-no-files-found: error
           path: |
             .delta.*
             pr_number