[CI] Configure workflow permissions

.github/workflows/argilla-frontend.build-push-dev-frontend-docker.yml

@@ -48,7 +48,7 @@ jobs:
     # Grant permissions to `GITHUB_TOKEN` for Google Cloud Workload Identity Provider
     permissions:
       contents: read
-      # id-token: write
+      id-token: write
 
     outputs:
       version: ${{ steps.docker-image-tag-from-ref.outputs.docker-image-tag }}
@@ -62,8 +62,8 @@ jobs:
 
       - name: Build Frontend
         run: |
-            npm install
-            npm run build
+          npm install
+          npm run build
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
@@ -91,7 +91,7 @@ jobs:
       # Authenticate in GCP using Workload Identity Federation, so we can push the Docker image to the Google Cloud Artifact Registry
       - name: Authenticate to Google Cloud
         id: google-auth
-        uses: 'google-github-actions/auth@v1'
+        uses: "google-github-actions/auth@v1"
         with:
           token_format: access_token
           workload_identity_provider: ${{ secrets.GOOGLE_CLOUD_WIP }}

.github/workflows/argilla-frontend.deploy-environment.yml

@@ -28,8 +28,8 @@ jobs:
     # Grant permissions to `GITHUB_TOKEN` for Google Cloud Workload Identity Provider
     permissions:
       contents: read
-      # id-token: write
-      # pull-requests: write
+      id-token: write
+      pull-requests: write
 
     steps:
       - uses: actions/checkout@v4

.github/workflows/argilla-frontend.yml

@@ -11,6 +11,11 @@ on:
     paths:
       - "argilla-frontend/**"
 
+permissions:
+  contents: read
+  id-token: write
+  pull-requests: write
+
 jobs:
   build:
     name: Build argilla-frontend

.github/workflows/argilla-server.yml

@@ -17,6 +17,9 @@ on:
     paths:
       - "argilla-server/**"
 
+permissions:
+  id-token: write
+
 jobs:
   build:
     name: Build `argilla-server` package

.github/workflows/argilla.docs.yml

@@ -19,6 +19,10 @@ defaults:
   run:
     working-directory: argilla
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   publish:
     runs-on: ubuntu-latest

.github/workflows/argilla.yml

@@ -17,6 +17,9 @@ on:
     paths:
       - "argilla/**"
 
+permissions:
+  id-token: write
+
 jobs:
   build:
     services:
@@ -85,8 +88,6 @@ jobs:
       # contents: read
       # IMPORTANT: this permission is mandatory for trusted publishing on PyPI
       id-token: write
-      # This permission is needed for creating tags
-      contents: write
 
     needs:
       - build

.github/workflows/close-inactive-issues-bot.yml

@@ -3,6 +3,10 @@ on:
   schedule:
     - cron: "30 1 * * *"
 
+permissions:
+  issues: write
+  pull-requests: write
+
 jobs:
   close-issues:
     runs-on: ubuntu-latest

argilla-frontend/nuxt.config.ts

@@ -14,6 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+// Include comment to force buils
 
 import Mode from "frontmatter-markdown-loader/mode";
 import { NuxtConfig } from "@nuxt/types";