Chore: narrow/specify some workflow permissions (#7051)

.github/workflows/crowdin.yml

@@ -10,6 +10,10 @@ on:
     ]
     branches: [ dev ]
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   synchronize-with-crowdin:
     name: Crowdin Sync

.github/workflows/docker-publish.yml

@@ -17,6 +17,8 @@ on:
 env:
   IMAGE_NAME: ${{ github.repository }}
 
+permissions: {}
+
 jobs:
 
 
@@ -27,7 +29,6 @@ jobs:
     permissions:
       contents: read
       packages: write
-      id-token: write
 
     steps:
       - name: Checkout repository

.github/workflows/docs-publish.yml

@@ -10,8 +10,6 @@ on:
 
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 jobs:
 
@@ -33,6 +31,10 @@ jobs:
     name: Build & Deploy Docs
     if: github.repository == 'gethomepage/homepage' && github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}

.github/workflows/issue-triage.yml

@@ -6,15 +6,15 @@ on:
   discussion:
     types: [labeled]
 
-permissions:
-  discussions: write
-  issues: write
+permissions: {}
 
 jobs:
   close-needs-discussion:
     name: Issues Need Discussion
     if: github.event_name == 'issues' && github.event.label.name == 'needs-discussion'
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
     steps:
       - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
@@ -49,6 +49,8 @@ jobs:
     name: Discussions Need Information
     if: github.event_name == 'discussion' && github.event.label.name == 'needs-information'
     runs-on: ubuntu-latest
+    permissions:
+      discussions: write
     steps:
       - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:

.github/workflows/lint.yml

@@ -6,6 +6,9 @@ on:
   workflow_dispatch:
   merge_group:
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: Linting Checks

.github/workflows/pr-quality.yml

@@ -2,7 +2,6 @@ name: PR Quality
 
 permissions:
   contents: read
-  issues: read
   pull-requests: write
 
 on:

.github/workflows/pr-triage.yml

@@ -5,7 +5,6 @@ on:
     types: [labeled]
 
 permissions:
-  issues: write
   pull-requests: write
 
 jobs:

.github/workflows/repo-maintenance.yml

@@ -5,10 +5,7 @@ on:
     - cron: '0 3 * * *'
   workflow_dispatch:
 
-permissions:
-  issues: write
-  pull-requests: write
-  discussions: write
+permissions: {}
 
 concurrency:
   group: lock
@@ -17,6 +14,9 @@ jobs:
   stale:
     name: 'Stale'
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
     steps:
       - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10
         with:
@@ -31,6 +31,10 @@ jobs:
   lock-threads:
     name: 'Lock Old Threads'
     runs-on: ubuntu-latest
+    permissions:
+      discussions: write
+      issues: write
+      pull-requests: write
     steps:
       - uses: dessant/lock-threads@89ae32b08ed1a541efecbab17912962a5e38981c # v6.0.2
         with:
@@ -56,6 +60,8 @@ jobs:
   close-answered-discussions:
     name: 'Close Answered Discussions'
     runs-on: ubuntu-latest
+    permissions:
+      discussions: write
     steps:
       - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
@@ -112,6 +118,8 @@ jobs:
   close-outdated-discussions:
     name: 'Close Outdated Discussions'
     runs-on: ubuntu-latest
+    permissions:
+      discussions: write
     steps:
       - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
@@ -203,6 +211,8 @@ jobs:
   close-unsupported-feature-requests:
     name: 'Close Unsupported Feature Requests'
     runs-on: ubuntu-latest
+    permissions:
+      discussions: write
     steps:
       - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:

.github/workflows/test.yml

@@ -5,6 +5,9 @@ on:
   push:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   vitest:
     runs-on: ubuntu-latest