fix(lint): checkov findings

.github/workflows/compress-images.yml

@@ -2,10 +2,17 @@
 # Compress images on demand (workflow_dispatch), and at 11pm every Sunday (schedule).
 # Open a Pull Request if any images can be compressed.
 name: Compress Images on Demand
+
 on:
   workflow_dispatch:
   schedule:
     - cron: "00 23 * * 0"
+
+permissions:
+  contents: write
+  statuses: write
+  pull-requests: write
+
 jobs:
   CompressOnDemandOrSchedule:
     name: calibreapp/image-actions