Add explicit workflow permissions

.github/workflows/jscpd-duplication-check.yml

@@ -9,6 +9,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   call-jscpd-duplication-check:
     if: ${{ github.event.pull_request.draft == false }}
@@ -23,4 +27,3 @@ jobs:
       # The shared workflow reads jscpd v4's per-format `total` schema.
       command_to_run: 'pnpm dlx jscpd@4.0.8 --ignore "**/node_modules/**" --output report --reporters json'
       package_manager: 'pnpm'
-

.github/workflows/original-test.yml

@@ -4,6 +4,10 @@ on:
   pull_request:
     types: [assigned,  opened,  synchronize,  reopened]
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   lint-and-test:
     runs-on: ubuntu-latest

.github/workflows/secrets-scan.yml

@@ -9,6 +9,10 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   secrets-scan:
     runs-on: ubuntu-latest
@@ -23,4 +27,4 @@ jobs:
           GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE_KEY }}
           GITLEAKS_NOTIFY_USER_LIST: ${{ vars.GITLEAKS_NOTIFY_USER_LIST }}
           GITLEAKS_ENABLE_COMMENTS: 'true'
-          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: 'false'
+          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: 'false'

.github/workflows/test-myself.yml

@@ -4,6 +4,10 @@ on:
   pull_request:
     types: [assigned,  opened,  synchronize,  reopened]
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   lint-and-test:
     runs-on: ubuntu-latest