Merge pull request #170 from thin-edge/ci-set-default-permissions

ci: set default workflow permissions

Author: reubenmiller

.github/workflows/release.yaml

@@ -9,6 +9,9 @@ on:
 jobs:
   goreleaser:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/test.yaml

@@ -10,6 +10,10 @@ on:
   pull_request_target:
     branches: [ main ]
   merge_group:
+
+permissions:
+  contents: read
+
 jobs:
   approve:
     name: Approve
@@ -26,7 +30,10 @@ jobs:
     name: Test ${{ matrix.job.image }}
     needs: [approve]
     permissions:
+      # Required to publish system test results to the PR
+      issues: write
       pull-requests: write
+      contents: read
     environment:
       name: Test Auto
     runs-on: ubuntu-latest