tighten github workflow permissions

.github/workflows/ci.yml

@@ -7,6 +7,8 @@
 # licenses/APL2.txt.
 
 name: ci
+permissions:
+  contents: read
 
 on:
   push:

.github/workflows/openapi-pr.yml

@@ -7,12 +7,18 @@
 # licenses/APL2.txt.
 
 name: openapi-pr
+permissions:
+  contents: read
+  pull-requests: write
 
 on:
   pull_request:
     # Only run when we change an API spec
     paths:
       - 'docs/api/**'
+      - .redocly.yaml
+      - .yamllint.yml
+      - github/workflows/openapi-pr.yml
     branches:
       - 'master'
       - 'main'

.github/workflows/openapi.yml

@@ -7,12 +7,17 @@
 # licenses/APL2.txt.
 
 name: openapi
+permissions:
+  contents: read
 
 on:
   push:
     # Only run when we change an API spec
     paths:
       - 'docs/api/**'
+      - .redocly.yaml
+      - .yamllint.yml
+      - github/workflows/openapi.yml
     branches:
       - 'master'
       - 'main'

.github/workflows/service.yml

@@ -7,13 +7,16 @@
 # licenses/APL2.txt.
 
 name: service
+permissions:
+  contents: read
 
 on:
   push:
     # Only run when we modify service files
     paths:
       - 'service/**'
       - 'integration-test/**'
+      - 'github/workflows/service.yml'
     branches:
       - 'main'
       - 'release/*'