ci: set permissions

Author: sapphi-red

.github/workflows/ci.yml

@@ -9,6 +9,8 @@ env:
   # Vitest auto retry on flaky segfault
   VITEST_SEGFAULT_RETRY: 3
 
+permissions: {}
+
 on:
   push:
     branches:

.github/workflows/issue-close-require.yml

@@ -8,6 +8,9 @@ jobs:
   close-issues:
     if: github.repository == 'vitejs/vite-plugin-vue'
     runs-on: ubuntu-latest
+    permissions:
+      issues: write # for actions-cool/issues-helper to update issues
+      pull-requests: write # for actions-cool/issues-helper to update PRs
     steps:
       - name: need reproduction
         uses: actions-cool/issues-helper@v3

.github/workflows/issue-labeled.yml

@@ -8,6 +8,9 @@ jobs:
   reply-labeled:
     if: github.repository == 'vitejs/vite-plugin-vue'
     runs-on: ubuntu-latest
+    permissions:
+      issues: write # for actions-cool/issues-helper to update issues
+      pull-requests: write # for actions-cool/issues-helper to update PRs
     steps:
       - name: contribution welcome
         if: github.event.label.name == 'contribution welcome' || github.event.label.name == 'help wanted'

.github/workflows/release-continuous.yml

@@ -1,6 +1,8 @@
 name: Publish Any Commit
 on: [push, pull_request]
 
+permissions: {}
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/release-tag.yml

@@ -13,6 +13,8 @@ jobs:
   release:
     if: github.repository == 'vitejs/vite-plugin-vue'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # for yyx990803/release-tag to create a release tag
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/semantic-pull-request.yml

@@ -12,6 +12,8 @@ jobs:
     if: github.repository == 'vitejs/vite-plugin-vue'
     runs-on: ubuntu-latest
     name: Semantic Pull Request
+    permissions:
+      pull-requests: read
     steps:
       - name: Validate PR title
         uses: amannn/action-semantic-pull-request@v5