update: set explicit permissions in GitHub workflows (1/2) (#151)

update: set explicit permissions in GitHub workflows (1/2)

PR 1: pull_request related workflows only

See https://github.com/swift-server/swift-prometheus/issues/150

CC @FranzBusch

Signed-off-by: Melissa Kilby <mkilby@apple.com>
Co-authored-by: Franz Busch <privat@franz-busch.de>

.github/workflows/pull_request.yml

@@ -4,6 +4,9 @@ on:
   pull_request:
     types: [opened, reopened, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   soundness:
     name: Soundness

.github/workflows/pull_request_label.yml

@@ -4,6 +4,9 @@ on:
   pull_request:
     types: [labeled, unlabeled, opened, reopened, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   semver-label-check:
     name: Semantic version label check