ci: scope down GitHub Token permissions (#3142)

Co-authored-by: Matt Creaser <[email protected]>

Author: AdnaneKhan

.github/workflows/codecov_code_coverage.yml

@@ -9,6 +9,9 @@ on:
       - 'main'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/notify_pull_request.yml

@@ -4,6 +4,9 @@ on:
   pull_request:
     types: [opened, ready_for_review, reopened]
 
+permissions:
+  contents: read
+
 jobs:
   notify:
     runs-on: ubuntu-latest

.github/workflows/notify_release.yml

@@ -9,6 +9,9 @@ on:
     types: [created, published]
 
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
+permissions:
+  contents: read
+
 jobs:
   # This workflow contains a single job called "notify"
   notify:

.github/workflows/pr_title_checker.yml

@@ -10,6 +10,9 @@ on:
       - labeled
       - unlabeled
 
+permissions:
+  contents: read
+
 jobs:
   check:
     runs-on: ubuntu-latest

.github/workflows/release_pr.yml

@@ -18,6 +18,10 @@ env:
   GIT_USER_NAME: amplify-android-dev+ghops
   GIT_USER_EMAIL: [email protected]
   BASE_BRANCH: ${{ github.ref_name }}
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   create_pr_for_next_release:
     runs-on: ubuntu-latest

.github/workflows/stale.yml

@@ -4,6 +4,10 @@ on:
   schedule:
   - cron: "30 1 * * *"
 
+permissions:
+  issues: write
+  pull-requests: write
+
 jobs:
   stale:
     runs-on: ubuntu-latest