Chore: Harden github token permissions (#1879)

Author: oshirohugo

.github/workflows/ci.yml

@@ -432,6 +432,8 @@ jobs:
         with:
           app-id: ${{ env.GITHUB_APP_ID }}
           private-key: ${{ env.GITHUB_APP_PRIVATE_KEY }}
+          permission-actions: read
+          permission-contents: write
 
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:

.github/workflows/lapo-create-pr.yml

@@ -36,6 +36,11 @@ jobs:
         with:
           app-id: ${{ env.GITHUB_APP_ID }}
           private-key: ${{ env.GITHUB_APP_PEM }}
+          # Permissions necessary for grafana/lapo-docs/github-actions/create-docs-update-pr
+          permission-actions: read
+          permission-contents: write
+          permission-pull-requests: write
+          permission-issues: write
 
 
       # this allows to test both with manual trigger and repository_dispatch