Set permissions on workflows (#42)

Author: sethvargo

.github/workflows/draft-release.yml

@@ -11,6 +11,14 @@ on:
       ACTIONS_BOT_TOKEN:
         required: true
 
+permissions:
+  contents: 'read'
+  pull-requests: 'write'
+
+defaults:
+  run:
+    shell: 'bash'
+
 jobs:
   draft-release:
     name: 'Draft Release'

.github/workflows/lint.yml

@@ -19,6 +19,10 @@ permissions:
   contents: 'read'
   statuses: 'write'
 
+defaults:
+  run:
+    shell: 'bash'
+
 jobs:
   init:
     name: 'Lint (Initialize)'
@@ -41,7 +45,6 @@ jobs:
         env:
           REF: '${{ github.event.pull_request.head.sha }}'
           LC_ALL: 'C'
-        shell: 'bash'
         run: |-
           set -euo pipefail
 

.github/workflows/release.yml

@@ -6,6 +6,15 @@ on:
       ACTIONS_BOT_TOKEN:
         required: true
 
+permissions:
+  attestations: 'write'
+  contents: 'write'
+  packages: 'write'
+
+defaults:
+  run:
+    shell: 'bash'
+
 jobs:
   create-release:
     if: |-