Token permissions (#1580)

* Run continuous_integration.yml with read-only permissions

Signed-off-by: Pedro Kaj Kjellerup Nacht <pnacht@google.com>

* Future-proof other workflow tokens

Signed-off-by: Pedro Kaj Kjellerup Nacht <pnacht@google.com>

---------

Signed-off-by: Pedro Kaj Kjellerup Nacht <pnacht@google.com>

Author: pnacht

.github/workflows/auto-assignment.yaml

@@ -8,12 +8,13 @@ on:
 
 permissions:
   contents: read
-  issues: write
-  pull-requests: write
 
 jobs:
   welcome:
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
     steps:
       - uses: actions/checkout@v3
       - uses: actions/github-script@v6

.github/workflows/continuous_integration.yml

@@ -5,6 +5,9 @@ on:
     branches: [master]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   black:
     runs-on: ubuntu-latest

.github/workflows/stale-issues-pr.yml

@@ -3,6 +3,9 @@ on:
   schedule:
     - cron: "30 1 * * *"
 
+permissions:
+  contents: read
+
 jobs:
   close-issues:
     runs-on: ubuntu-latest