ci: explicit permissions on actions

revoke pull_request_target

Author: doublethink

.github/workflows/coverage.yml

@@ -6,6 +6,9 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   coverage:
     name: Generate Combined Coverage

.github/workflows/functions_client.yml

@@ -15,6 +15,9 @@ on:
       - '.github/workflows/functions_client.yml'
       - 'packages/yet_another_json_isolate/**'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test SDK ${{ matrix.sdk }}

.github/workflows/gotrue.yml

@@ -13,6 +13,9 @@ on:
       - 'packages/gotrue/**'
       - '.github/workflows/gotrue.yml'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test SDK ${{ matrix.sdk }}

.github/workflows/postgrest.yml

@@ -15,6 +15,9 @@ on:
       - '.github/workflows/postgrest.yml'
       - 'packages/yet_another_json_isolate/**'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test SDK ${{ matrix.sdk }}

.github/workflows/realtime_client.yml

@@ -13,6 +13,9 @@ on:
       - 'packages/realtime_client/**'
       - '.github/workflows/realtime_client.yml'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test SDK ${{ matrix.sdk }}

.github/workflows/storage_client.yml

@@ -12,6 +12,9 @@ on:
       - 'packages/storage_client/**'
       - '.github/workflows/storage_client.yml'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test SDK ${{ matrix.sdk }}

.github/workflows/supabase.yml

@@ -23,6 +23,9 @@ on:
       - 'packages/realtime_client/**'
       - 'packages/storage_client/**'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test SDK ${{ matrix.sdk }}

.github/workflows/supabase_flutter.yml

@@ -27,6 +27,9 @@ on:
       - 'packages/supabase/**'
       - 'packages/yet_another_json_isolate/**'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test Flutter v${{ matrix.flutter-version }}

.github/workflows/title-validation.yml

@@ -2,12 +2,16 @@
 name: 'PR Title is Conventional'
 
 on:
-  pull_request_target:
+  pull_request:
     types:
       - opened
       - edited
       - synchronize
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   main:
     name: Validate PR title

.github/workflows/yet_another_json_isolate.yml

@@ -13,6 +13,9 @@ on:
       - 'packages/yet_another_json_isolate/**'
       - '.github/workflows/yet_another_json_isolate.yml'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test SDK ${{ matrix.sdk }}