Set specific permissions on workflows.

.github/workflows/approved_status.yml

@@ -1,5 +1,9 @@
 name: Send PR Approval Status
 
+permissions: 
+  contents: read
+  pull-requests: write
+
 on:
   pull_request:
     branches:

.github/workflows/changelog.yml

@@ -1,4 +1,9 @@
 name: "Ensure labels"
+
+permissions:
+  contents: read
+  pull-requests: read
+
 on: # yamllint disable-line rule:truthy
   pull_request:
     types:

.github/workflows/codeql-analysis.yml

@@ -1,5 +1,9 @@
 name: "CodeQL"
 
+permissions: 
+  contents: read
+  checks: write
+
 on:
   push:
     branches: [ "master" ]

.github/workflows/docs.yml

@@ -1,5 +1,8 @@
 name: docs
 
+permissions: 
+  contents: write
+
 on:
   push:
     branches:

.github/workflows/labeler.yml

@@ -1,4 +1,9 @@
 name: "Pull Request Labeler"
+
+permissions: 
+  contents: read
+  pull-requests: write
+
 on:
   - pull_request
 

.github/workflows/prepare_release.yml

@@ -1,5 +1,9 @@
 name: Prepare release
 
+permissions:
+  contents: write
+  pull-requests: write
+
 env:
   GIT_AUTHOR_EMAIL: "packages@datadoghq.com"
   GIT_AUTHOR_NAME: "ci.datadog-api-spec"

.github/workflows/publish.yml

@@ -1,5 +1,10 @@
 name: Publish
 
+permissions: 
+  contents: write
+  attestations: write
+  pull-requests: write
+
 on:
   release:
     types:

.github/workflows/release.yml

@@ -1,5 +1,9 @@
 name: Release
 
+permissions:
+  contents: write
+  pull-requests: write
+
 env:
   GIT_AUTHOR_EMAIL: "packages@datadoghq.com"
   GIT_AUTHOR_NAME: "ci.datadog-api-spec"

.github/workflows/stale.yml

@@ -1,6 +1,12 @@
 # Configuration for https://github.com/actions/stale
 
 name: "Stale issues and pull requests"
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+
 on:
   schedule:
     - cron: "0 0 * * *"

.github/workflows/test.yml

@@ -1,5 +1,8 @@
 name: Run Tests
 
+permissions: 
+  contents: read
+
 env:
   GIT_AUTHOR_EMAIL: "packages@datadoghq.com"
   GIT_AUTHOR_NAME: "ci.datadog-api-spec"

.github/workflows/test_integration.yml

@@ -1,5 +1,8 @@
 name: Run Integration Tests
 
+permissions:
+  contents: read
+
 on:
   pull_request:
     types: