Fix github actions permissions (#2842)

bwoebi · web-flow · commit 98839cf637ca · 2024-09-06T15:57:28.000+02:00
As inspired by DataDog/dd-trace-dotnet#5728. Signed-off-by: Bob Weinand <bob.weinand@datadoghq.com>
diff --git a/.github/workflows/auto_add_pr_to_miletone.yml b/.github/workflows/auto_add_pr_to_miletone.yml
@@ -11,6 +11,11 @@ jobs:
   add_to_milestone:
     if: github.event.pull_request.merged == true && startsWith(github.event.pull_request.title, '[Version Bump]') == false
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write # need to modify existing PR
+      issues: write # need to potentially create a new milestone
+
     steps:
       - name: Checkout
         uses: actions/checkout@v2
diff --git a/.github/workflows/auto_check_snapshots.yml b/.github/workflows/auto_check_snapshots.yml
@@ -6,6 +6,9 @@ on:
 jobs:
   check-snapshots:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write # need to add a comment to a PR
 
     steps:
       - name: Checkout
diff --git a/.github/workflows/auto_label_prs.yml b/.github/workflows/auto_label_prs.yml
@@ -7,6 +7,10 @@ jobs:
   add-labels:
 
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write # Update labels on PRs (might not be necessary, but we call the UpdateIssue API so...)
+      pull-requests: write # Update labels on PRs
 
     steps:
       - name: Checkout
