[ci] Make workflow permissions explicit

Author: joffrey-bion

.github/workflows/ci.yml

@@ -4,10 +4,12 @@ on:
   push:
     branches: [ "*" ]
     paths-ignore:
-      - 'mkdocs.yml'
       - 'docs/**'
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ${{ matrix.os }}

.github/workflows/dependabot-pr-post-processing.yml

@@ -4,9 +4,10 @@ on:
   pull_request:
     types: [opened, synchronize, reopened]
 
+# We don't need any permissions here, because they are handled in the PAT.
+# We need the PAT because Dependabot workflows don't have enough permissions to process the PRs properly.
 permissions:
-  contents: write # to commit yarn.lock
-  pull-requests: write # to label PRs
+  contents: none
 
 jobs:
   dependabot-pr-post-processing:

.github/workflows/publish-website.yml

@@ -8,6 +8,9 @@ on:
 
 run-name: "Website update (${{ github.ref_name }})"
 
+permissions:
+  contents: write # to push to the gh-pages branch
+
 jobs:
   publish-website:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -14,6 +14,9 @@ on:
 
 run-name: "Release ${{ inputs.version }}"
 
+permissions:
+  contents: read
+
 jobs:
   release:
     runs-on: macos-latest # For darwin publications