CI: Resolve OSSF GitHub token permissions security alert (#2891)

.github/workflows/e2e-test.yml

@@ -2,6 +2,8 @@ name: Test Deployment
 on:
   deployment_status:
 
+permissions: read-all
+
 jobs:
   e2eTests:
     if:

.github/workflows/empty-issues-closer.yaml

@@ -6,6 +6,21 @@ on:
       - opened
       - edited
 
+permissions:
+  actions: read
+  checks: read
+  contents: read
+  deployments: read
+  id-token: read
+  issues: write
+  discussions: read
+  packages: read
+  pages: read
+  pull-requests: read
+  repository-projects: read
+  security-events: read
+  statuses: read
+
 jobs:
   closeEmptyIssuesAndTemplates:
     if: github.repository == 'anuraghazra/github-readme-stats'

.github/workflows/generate-theme-doc.yml

@@ -6,6 +6,21 @@ on:
     paths:
       - "themes/index.js"
 
+permissions:
+  actions: read
+  checks: read
+  contents: write
+  deployments: read
+  id-token: read
+  issues: read
+  discussions: read
+  packages: read
+  pages: read
+  pull-requests: read
+  repository-projects: read
+  security-events: read
+  statuses: read
+
 jobs:
   generateThemeDoc:
     runs-on: ubuntu-latest

.github/workflows/label-pr.yml

@@ -2,6 +2,21 @@ name: "Pull Request Labeler"
 on:
   - pull_request_target
 
+permissions:
+  actions: read
+  checks: read
+  contents: read
+  deployments: read
+  id-token: read
+  issues: read
+  discussions: read
+  packages: read
+  pages: read
+  pull-requests: write
+  repository-projects: read
+  security-events: read
+  statuses: read
+
 jobs:
   triage:
     if: github.repository == 'anuraghazra/github-readme-stats'

.github/workflows/preview-theme.yml

@@ -7,6 +7,21 @@ on:
     paths:
       - "themes/index.js"
 
+permissions:
+  actions: read
+  checks: read
+  contents: read
+  deployments: read
+  id-token: read
+  issues: read
+  discussions: read
+  packages: read
+  pages: read
+  pull-requests: write
+  repository-projects: read
+  security-events: read
+  statuses: read
+
 jobs:
   previewTheme:
     name: Install & Preview

.github/workflows/prs-cache-clean.yml

@@ -4,6 +4,21 @@ on:
     types:
       - closed
 
+permissions:
+  actions: write
+  checks: read
+  contents: read
+  deployments: read
+  id-token: read
+  issues: read
+  discussions: read
+  packages: read
+  pages: read
+  pull-requests: read
+  repository-projects: read
+  security-events: read
+  statuses: read
+
 jobs:
   cleanup:
     runs-on: ubuntu-latest

.github/workflows/stale-theme-pr-closer.yaml

@@ -3,6 +3,21 @@ on:
   schedule:
     - cron: "0 0 */7 * *"
 
+permissions:
+  actions: read
+  checks: read
+  contents: read
+  deployments: read
+  id-token: read
+  issues: read
+  discussions: read
+  packages: read
+  pages: read
+  pull-requests: write
+  repository-projects: read
+  security-events: read
+  statuses: read
+
 jobs:
   closeOldThemePrs:
     if: github.repository == 'anuraghazra/github-readme-stats'

.github/workflows/test.yml

@@ -7,6 +7,8 @@ on:
     branches:
       - master
 
+permissions: read-all
+
 jobs:
   build:
     name: Perform tests

.github/workflows/top-issues-dashboard.yml

@@ -4,6 +4,21 @@ on:
     - cron: "0 0 */3 * *"
   workflow_dispatch:
 
+permissions:
+  actions: read
+  checks: read
+  contents: read
+  deployments: read
+  id-token: read
+  issues: write
+  discussions: read
+  packages: read
+  pages: read
+  pull-requests: write
+  repository-projects: read
+  security-events: read
+  statuses: read
+
 jobs:
   showAndLabelTopIssues:
     if: github.repository == 'anuraghazra/github-readme-stats'

.github/workflows/update-langs.yaml

@@ -3,6 +3,21 @@ on:
   schedule:
     - cron: "0 0 */30 * *"
 
+permissions:
+  actions: read
+  checks: read
+  contents: read
+  deployments: read
+  id-token: read
+  issues: read
+  discussions: read
+  packages: read
+  pages: read
+  pull-requests: write
+  repository-projects: read
+  security-events: read
+  statuses: read
+
 jobs:
   updateLanguages:
     if: github.repository == 'anuraghazra/github-readme-stats'