Add explicit permissions block to GitHub Actions workflows (#5151)

Author: jitu5

.github/workflows/all-checks.yml

@@ -21,6 +21,9 @@ on:
       - "docs/**"
       - '**.md'
 
+permissions:
+  contents: read
+
 jobs:
   unit-tests:
     strategy:

.github/workflows/auto-merge-prs.yml

@@ -9,6 +9,9 @@ on:
 
 jobs:
   automerge:
+    permissions:
+      contents: write
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - name: Checkout

.github/workflows/benchmark-performance.yml

@@ -10,6 +10,8 @@ on:
 jobs:
 
   benchmark:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/check-release.yml

@@ -5,6 +5,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   check-version:
     runs-on: ubuntu-latest
@@ -37,6 +40,8 @@ jobs:
     uses: ./.github/workflows/all-checks.yml
 
   build-publish:
+    permissions:
+      contents: write
     needs: [check-version, test-kedro]
     if: |
       always() &&

.github/workflows/detect-secrets.yml

@@ -13,6 +13,8 @@ on:
 
 jobs:
   detect-secrets:
+    permissions:
+      contents: read
     runs-on: ${{ inputs.os }}
     steps:
       - name: Checkout code

.github/workflows/docs-language-linter.yml

@@ -8,6 +8,9 @@ on:
 
 jobs:
   vale:
+    permissions:
+      contents: read
+      pull-requests: write
     name: runner / vale
     runs-on: ubuntu-latest
     steps:

.github/workflows/docs-only-checks.yml

@@ -18,6 +18,8 @@ on:
 
 jobs:
   lint:
+    permissions:
+      contents: read
     strategy:
       matrix:
         os: [ ubuntu-latest ]

.github/workflows/e2e-tests.yml

@@ -17,6 +17,8 @@ env:
 
 jobs:
   e2e-tests:
+    permissions:
+      contents: read
     runs-on: ${{ inputs.os }}
     steps:
       - name: Checkout code

.github/workflows/label-community-issues.yml

@@ -7,6 +7,8 @@ on:
 
 jobs:
   label:
+    permissions:
+      issues: write
     runs-on: ubuntu-latest
     steps:
       - name: Check if issue author is a member of Kedro org

.github/workflows/lint.yml

@@ -13,6 +13,8 @@ on:
 
 jobs:
   lint:
+    permissions:
+      contents: read
     runs-on: ${{ inputs.os }}
     steps:
       - name: Checkout code