ci: scope down GitHub Token permissions

.github/workflows/build.yml

@@ -8,6 +8,9 @@ on:
       - main
 env: 
   NODE_OPTIONS: "--max-old-space-size=28000"
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test

.github/workflows/docs.yml

@@ -11,6 +11,9 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: write
+
 jobs:
   test:
     runs-on: ubuntu-latest

.github/workflows/lint-prettier.yml

@@ -7,6 +7,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   typecheck:
     name: Typecheck

.github/workflows/publish.yml

@@ -4,6 +4,9 @@ on:
 
 name: Merge Release Branch
 
+permissions:
+  contents: write
+
 jobs:
   publish:
     name: Publish

.github/workflows/release.yml

@@ -10,6 +10,10 @@ on:
   push:
     branches:
       - "release/v*"
+permissions:
+  contents: write
+  pull-requests: read
+
 jobs:
   release:
     name: Create Release