fix(ci): permissions

.github/workflows/pr-lint.yml

@@ -1,4 +1,5 @@
 ---
+# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
 name: PR Lint
 
 on:
@@ -11,3 +12,8 @@ on:
 jobs:
   SuperLinter:
     uses: ivuorinen/.github/.github/workflows/pr-lint.yml@main
+    permissions:
+      contents: read
+      packages: read
+      statuses: write
+

.github/workflows/release-drafter.yml

@@ -1,10 +1,15 @@
 ---
+# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
 name: Release Drafter
 
-# yamllint disable-line rule:truthy
 on:
   workflow_call:
 
 jobs:
   Draft:
     uses: ivuorinen/.github/.github/workflows/sync-labels.yml@main
+    permissions:
+      contents: write
+      statuses: write
+      packages: read
+

.github/workflows/stale.yml

@@ -1,7 +1,7 @@
 ---
+# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
 name: Stale
 
-# yamllint disable-line rule:truthy
 on:
   schedule:
     - cron: '0 8 * * *'
@@ -10,8 +10,11 @@ on:
 
 jobs:
   stale:
+    uses: ivuorinen/.github/.github/workflows/stale.yml@main
     permissions:
-      contents: write
+      contents: write # only for delete-branch option
       issues: write
       pull-requests: write
-    uses: ivuorinen/.github/.github/workflows/stale.yml@main
+      statuses: read
+      packages: read
+

.github/workflows/static.yml

@@ -1,3 +1,5 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
 # Simple workflow for deploying static content to GitHub Pages
 name: Deploy static content to Pages
 

.github/workflows/sync-labels.yml

@@ -1,4 +1,5 @@
 ---
+# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
 name: Sync labels
 
 # yamllint disable-line rule:truthy
@@ -13,9 +14,11 @@ on:
   workflow_call:
   workflow_dispatch:
 
-permissions:
-  issues: write
-
 jobs:
   SyncLabels:
     uses: ivuorinen/.github/.github/workflows/sync-labels.yml@main
+    permissions:
+      issues: write
+      contents: read
+      statuses: read
+