ci: set top-level permissions as well

It should turn on the "restricted" mode by default regardless of
whether the global setting is on or not. New jobs in this action
should have to overwrite it explicitly to gain write access in any
way.

It should also make the action consistent with the other actions
writing various stuff like 'labeler' and 'codeql'.

diff --git a/.github/workflows/issue_labeler.yml b/.github/workflows/issue_labeler.yml
index c4143037ce3b3981ddd24842135a4bdc0c4f4521..64774e67cc30ff88b2798fd31fd520c4bc899963 100644 (file)
--- a/.github/workflows/issue_labeler.yml
+++ b/.github/workflows/issue_labeler.yml
@@ -5,6 +5,9 @@ on:
   issues:
     types: [ opened ]
 
+permissions:
+  contents: read
+
 jobs:
   label-component:
     runs-on: ubuntu-22.04