ci: set permissions (#417)

Author: sapphi-red

.github/workflows/ci.yml

@@ -9,6 +9,8 @@ env:
   # Vitest auto retry on flaky segfault
   VITEST_SEGFAULT_RETRY: 3
 
+permissions: {}
+
 on:
   push:
     branches:

.github/workflows/issue-close-require.yml

@@ -8,6 +8,9 @@ jobs:
   close-issues:
     if: github.repository == 'vitejs/vite-plugin-react'
     runs-on: ubuntu-latest
+    permissions:
+      issues: write # for actions-cool/issues-helper to update issues
+      pull-requests: write # for actions-cool/issues-helper to update PRs
     steps:
       - name: need reproduction
         uses: actions-cool/issues-helper@v3

.github/workflows/issue-labeled.yml

@@ -8,6 +8,9 @@ jobs:
   reply-labeled:
     if: github.repository == 'vitejs/vite-plugin-react'
     runs-on: ubuntu-latest
+    permissions:
+      issues: write # for actions-cool/issues-helper to update issues
+      pull-requests: write # for actions-cool/issues-helper to update PRs
     steps:
       - name: contribution welcome
         if: github.event.label.name == 'contribution welcome' || github.event.label.name == 'help wanted'

.github/workflows/publish.yml

@@ -8,6 +8,8 @@ on:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # for ArnaudBarre/github-release to create a release
     environment: Release
     steps:
       - name: Checkout

.github/workflows/semantic-pull-request.yml

@@ -12,6 +12,8 @@ jobs:
     if: github.repository == 'vitejs/vite-plugin-react'
     runs-on: ubuntu-latest
     name: Semantic Pull Request
+    permissions:
+      pull-requests: read
     steps:
       - name: Validate PR title
         uses: amannn/action-semantic-pull-request@v5