security: add permissions block to workflows

.github/workflows/addToProject.yml

@@ -8,6 +8,9 @@ on:
 env:
   MY_GITHUB_TOKEN: ${{ secrets.APM_TECH_USER_TOKEN }}
 
+permissions:
+  contents: read
+
 jobs:
   assign_one_project:
     runs-on: ubuntu-latest

.github/workflows/build-packages.yml

@@ -6,6 +6,9 @@ name: build-packages
 on:
   workflow_call: ~
 
+permissions:
+  contents: read
+
 jobs:
   build-packages:
     runs-on: ubuntu-latest

.github/workflows/build.yml

@@ -6,6 +6,9 @@ name: build
 on:
   workflow_call: ~
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: build-agent-library

.github/workflows/generate-matrix.yml

@@ -10,6 +10,9 @@ on:
         description: "The matrix"
         value: ${{ jobs.generate-matrix.outputs.include }}
 
+permissions:
+  contents: read
+
 jobs:
   generate-matrix:
     timeout-minutes: 5

.github/workflows/labeler.yml

@@ -5,6 +5,11 @@ on:
   pull_request_target:
     types: [opened]
 
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
 jobs:
   triage:
     runs-on: ubuntu-latest

.github/workflows/test-packages.yml

@@ -20,6 +20,9 @@ on:
         required: false
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   test-packages:
     timeout-minutes: 120

.github/workflows/test-reporter.yml

@@ -9,6 +9,11 @@ on:
       - test
     types: [completed]
 
+permissions:
+  contents: read
+  actions: read
+  checks: write
+
 jobs:
   report:
     runs-on: ubuntu-latest