Minimize GHA permissions

.github/workflows/branch.yml

@@ -4,6 +4,8 @@ name: Branch Checks
 on:
   pull_request:
 
+permissions: {}
+
 jobs:
   target_branch:
     name: PR targets branch

.github/workflows/codeowners.yml

@@ -7,6 +7,8 @@ on:
       - 'CODEOWNERS'
       - 'CODEOWNERS.in'
 
+permissions: {}
+
 jobs:
   updated:
     name: Up-to-date

.github/workflows/dependent-issues.yml

@@ -19,6 +19,11 @@ on:
   schedule:
     - cron: '0 0/6 * * *'  # every 6 hours
 
+permissions:
+  issues: write
+  pull-requests: write
+  statuses: write
+
 jobs:
   check:
     name: Check Dependencies

.github/workflows/e2e.yml

@@ -4,6 +4,8 @@ name: End to End Tests
 on:
   pull_request:
 
+permissions: {}
+
 jobs:
   e2e:
     name: E2E

.github/workflows/linting.yml

@@ -4,6 +4,8 @@ name: Linting
 on:
   pull_request:
 
+permissions: {}
+
 jobs:
   apply-suggestions-commits:
     name: 'No "Apply suggestions from code review" Commits'

.github/workflows/periodic.yml

@@ -5,6 +5,8 @@ on:
   schedule:
     - cron: "0 0 * * 0"
 
+permissions: {}
+
 jobs:
   markdown-link-check-periodic:
     name: Markdown Links (all files)

.github/workflows/release.yml

@@ -8,6 +8,12 @@ on:
     paths:
       - 'releases/**'
 
+permissions:
+  contents: write
+  packages: write
+  pull-requests: write
+  issues: write
+
 jobs:
   release:
     name: Release

.github/workflows/validation.yml

@@ -4,6 +4,8 @@ name: Validation
 on:
   pull_request:
 
+permissions: {}
+
 jobs:
   yamls:
     name: Release YAMLs