ci: improve permissions on pipeline

Author: deandreamatias

.github/workflows/base-beta.yaml

@@ -13,6 +13,8 @@ on:
 
   workflow_dispatch:
 
+  permissions:
+    contents: read
 # This ensures that previous jobs for the PR are canceled when PR is updated
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}

.github/workflows/base.yaml

@@ -11,6 +11,9 @@ on:
 
   workflow_dispatch:
 
+  permissions:
+    contents: read
+
 # This ensures that previous jobs for the PR are canceled when PR is updated
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}

.github/workflows/pr.yaml

@@ -9,6 +9,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: PR Conventional Commit Validation
+        permissions:
+          contents: read
         uses:  ytanikin/PRConventionalCommits@1.3.0
         with:
          task_types: '["feat","fix","docs","test","ci","refactor","perf","chore","revert"]'

.github/workflows/stale.yaml

@@ -6,6 +6,10 @@ on:
 jobs:
   stale:
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
+      contents: write
     steps:
       - uses: actions/stale@v10
         with: