update: set explicit permissions in GitHub workflows (1/2) (#151)

update: set explicit permissions in GitHub workflows (1/2)

PR 1: pull_request related workflows only

See #150

CC @FranzBusch

Signed-off-by: Melissa Kilby <[email protected]>
Co-authored-by: Franz Busch <[email protected]>

Author: incertum

.github/workflows/pull_request.yml

@@ -4,6 +4,9 @@ on:
   pull_request:
     types: [opened, reopened, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   soundness:
     name: Soundness

.github/workflows/pull_request_label.yml

@@ -4,6 +4,9 @@ on:
   pull_request:
     types: [labeled, unlabeled, opened, reopened, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   semver-label-check:
     name: Semantic version label check