chore(ci): address codeql alerts

explicitly set permissions for gha workflows

Author: kelly-sovacool

.github/workflows/build-docker-auto.yml

@@ -19,6 +19,9 @@
 
 name: build-docker-auto
 
+permissions:
+  contents: write
+
 on:
   push:
     branches:

.github/workflows/build-docker-manual.yml

@@ -20,6 +20,9 @@
 name: build-docker-manual
 run-name: build-docker ${{ inputs.dockerfile }}-${{ inputs.suffix }}
 
+permissions:
+  contents: write
+
 on:
   workflow_dispatch:
     inputs:

.github/workflows/draft-release.yml

@@ -12,6 +12,9 @@ on:
         type: string
         default: ""
 
+permissions:
+  contents: write
+
 jobs:
   draft-release:
     runs-on: ubuntu-latest

.github/workflows/post-release.yml

@@ -5,6 +5,9 @@ on:
     types:
       - published
 
+permissions:
+  contents: write
+
 jobs:
   cleanup:
     runs-on: ubuntu-latest

.github/workflows/techdev-project.yml

@@ -8,6 +8,10 @@ on:
     types:
       - opened
 
+permissions:
+  issues: read
+  pull-requests: read
+
 jobs:
   add-to-project:
     runs-on: ubuntu-latest

.github/workflows/user-projects.yml

@@ -8,6 +8,10 @@ on:
     types:
       - assigned
 
+permissions:
+  issues: read
+  pull-requests: read
+
 jobs:
   add-to-project:
     uses: CCBR/.github/.github/workflows/auto-add-user-project.yml@v0.1.0