Set top level permission of workflows to read only

Author: florentmaitre

.github/workflows/app-distribution-alpha.yml

@@ -3,6 +3,8 @@ name: app-distribution-alpha
 on:
   workflow_dispatch:
 
+permissions: read-all
+
 jobs:
   app-distribution-alpha:
     runs-on: ubuntu-latest

.github/workflows/app-distribution-beta.yml

@@ -5,6 +5,8 @@ on:
     - cron: '31 3 * * MON-FRI'
   workflow_dispatch:
 
+permissions: read-all
+
 jobs:
   app-distribution-beta:
     runs-on: ubuntu-latest

.github/workflows/build-docs.yml

@@ -15,6 +15,8 @@ on:
       - labeled
       - unlabeled
 
+permissions: read-all
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -76,6 +78,8 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     if: github.event_name != 'push' || github.ref != 'refs/heads/main'
+    permissions:
+      pull-requests: write  # Required to post comments on PRs
     steps:
       - name: Checkout code
         uses: actions/checkout@v6

.github/workflows/build.yml

@@ -14,6 +14,8 @@ on:
       - labeled
       - unlabeled
 
+permissions: read-all
+
 jobs:
   build:
     runs-on: ubuntu-latest