Add permissions to GH actions (#1413)

Author: evroon

.github/workflows/automerge.yml

@@ -1,10 +1,11 @@
 name: Dependabot auto-merge
-on: pull_request
 
 permissions:
   contents: write
   pull-requests: write
 
+on: pull_request
+
 jobs:
   dependabot:
     runs-on: ubuntu-24.04

.github/workflows/backend.yml

@@ -1,4 +1,8 @@
 name: backend
+
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   pull_request:

.github/workflows/contributors.yml

@@ -1,5 +1,9 @@
 name: contributors
 
+permissions:
+  contents: write
+  pull-requests: write
+
 on:
   workflow_dispatch:
   schedule:

.github/workflows/crowdin-pretranslate.yml

@@ -1,5 +1,9 @@
 # Run pre-translate with translation memory, all files/langs, at midnight daily.
 name: Crowdin Updates
+
+permissions:
+  contents: read
+
 on:
   schedule:
     - cron: '0 0 * * *'

.github/workflows/docker-build.yml

@@ -1,5 +1,8 @@
 name: docker
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   pull_request:

.github/workflows/docker-publish.yml

@@ -1,5 +1,8 @@
 name: docker publish
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   push:

.github/workflows/docs-build.yml

@@ -9,6 +9,9 @@ on:
     branches:
       - 'master'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-24.04

.github/workflows/docs-publish.yml

@@ -1,14 +1,14 @@
 name: docs
 
+permissions:
+  contents: write
+
 on:
   workflow_dispatch:
   push:
     branches:
       - 'master'
 
-permissions:
-  contents: write
-
 jobs:
   build:
     runs-on: ubuntu-24.04

.github/workflows/frontend.yml

@@ -1,5 +1,8 @@
 name: frontend
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   pull_request: