Add minimum token permissions for all GitHub workflow files

.github/workflows/close-stale.yml

@@ -3,9 +3,15 @@ on:
   schedule:
     - cron: '30 6 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   stale:
     runs-on: ubuntu-latest
+    permissions:
+      issues: write # required for closing issues and adding labels/comments
+      pull-requests: write # required for closing PRs and adding labels/comments
     steps:
       - uses: actions/stale@v9
         with:

.github/workflows/codeql-analysis.yml

@@ -6,10 +6,14 @@ on:
     branches: [ main ]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   CodeQL-Build:
     runs-on: ubuntu-latest
-
+    permissions:
+      security-events: write # required for uploading CodeQL analysis results
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4

.github/workflows/component-owners.yml

@@ -2,10 +2,15 @@ name: 'Component Owners'
 on:
   pull_request_target:
 
+permissions:
+  contents: read
+
 jobs:
   run_self:
     runs-on: ubuntu-latest
     name: Auto Assign Owners
+    permissions:
+      pull-requests: write # required for assigning reviewers and adding labels
     steps:
       - uses: dyladan/component-owners@main
         with:

.github/workflows/label-prs.yml

@@ -2,6 +2,9 @@ name: "Label PR"
 on:
   - pull_request_target
 
+permissions:
+  contents: read
+
 jobs:
   labeler:
     name: 'Add component labels'

.github/workflows/lint.yml

@@ -6,6 +6,9 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/peer-api.yaml

@@ -6,6 +6,9 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   peer-api-check:
     runs-on: ubuntu-latest

.github/workflows/pr-title.yml

@@ -7,10 +7,15 @@ on:
       - edited
       - synchronize
 
+permissions:
+  contents: read
+
 jobs:
   main:
     name: Validate PR title
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write # required for commenting on PRs about title validation
     steps:
       - uses: amannn/action-semantic-pull-request@v5
         env:

.github/workflows/release-please-validate.yaml

@@ -6,6 +6,9 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   rp-validate:
     runs-on: ubuntu-latest

.github/workflows/release-please.yml

@@ -3,11 +3,16 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 name: Run Release Please
 jobs:
   release-please:
     runs-on: ubuntu-latest
     permissions:
+      contents: write # required for release-please to create releases and update files
+      pull-requests: write # required for release-please to create and update PRs
       id-token: write
     steps:
       # The logic below handles the npm publication:

.github/workflows/test-all-versions.pr.yml

@@ -8,6 +8,9 @@ on:
       - labeled
       - unlabeled
 
+permissions:
+  contents: read
+
 jobs:
   parse-labels:
     runs-on: ubuntu-latest

.github/workflows/test-all-versions.push.yml

@@ -6,6 +6,9 @@ on:
       - "release/**"
       - "release-please/**"
 
+permissions:
+  contents: read
+
 jobs:
   tav:
     uses: ./.github/workflows/test-all-versions.yml

.github/workflows/test-all-versions.yml

@@ -12,6 +12,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   build-and-cache:
     strategy:

.github/workflows/unit-test.yml

@@ -4,6 +4,9 @@ on:
     branches: [main]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build-and-cache:
     strategy:

.github/workflows/update-otel-deps.yaml

@@ -3,6 +3,9 @@ name: Create or Update OpenTelemetry Update PR
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   create-or-update-deps-pr:
     runs-on: ubuntu-latest