CI: add least-privilege permissions to GitHub Actions workflows (#1894)

Author: peter-matkovski

.github/workflows/go-video-proto.yml

@@ -7,6 +7,9 @@ concurrency:
   group: ${{ github.ref }}-${{ github.workflow }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   protoc:
     runs-on: ubuntu-latest

.github/workflows/on-tag.yml

@@ -13,6 +13,10 @@ concurrency:
   group: ${{ github.ref }}-${{ github.workflow }}
   cancel-in-progress: true
 
+permissions:
+  contents: write
+  pull-requests: read
+
 jobs:
   version:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -9,6 +9,10 @@ concurrency:
   group: ${{ github.ref }}-${{ github.workflow }}
   cancel-in-progress: true
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   pull-request-on-release:
     name: Create Release PR

.github/workflows/typescript-video-proto.yml

@@ -7,6 +7,8 @@ concurrency:
   group: ${{ github.ref }}-${{ github.workflow }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   protoc:
     runs-on: ubuntu-latest