ci: add least-privilege permissions to GitHub Actions workflows

Restrict default GITHUB_TOKEN scope per workflow. Write scopes granted only
where jobs dispatch/cancel workflows, publish packages, or label issues/PRs.

Refs: APPSEC-164

Author: Peter Matkovski

.github/workflows/auto-approve.yml

@@ -6,6 +6,9 @@ on:
 env:
   GITHUB_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
 
+permissions:
+  pull-requests: write
+
 jobs:
   auto-approve:
     name: Auto Approve

.github/workflows/cherry-pick-auto.yml

@@ -11,6 +11,10 @@ on:
 env:
   GH_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
 
+permissions:
+  contents: read
+    pull-requests: write
+
 jobs:
   cherry-pick:
     if: ${{ github.event.pull_request.merged == true && (github.base_ref == 'main' || startsWith(github.base_ref, 'release-')) }}

.github/workflows/cherry-pick-label-check.yml

@@ -7,6 +7,10 @@ on:
       - main
       - release-*
 
+permissions:
+  contents: read
+    pull-requests: read
+
 jobs:
   pr-label-check:
     uses: apecloud/apecloud-cd/.github/workflows/pull-request-label-check.yml@v0.1.88

.github/workflows/cherry-pick-usage.yml

@@ -11,6 +11,9 @@ on:
 env:
   GH_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
 
+permissions:
+  contents: read
+
 jobs:
   cherry-pick-usage:
     uses: apecloud/apecloud-cd/.github/workflows/pull-request-cherry-pick-usage.yml@v0.1.88

.github/workflows/cherry-pick.yml

@@ -6,6 +6,10 @@ on:
 env:
   GH_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
 
+permissions:
+  contents: read
+    pull-requests: write
+
 jobs:
   cherry-pick:
     if: github.event.issue.pull_request != '' && contains(github.event.comment.body, '/cherry-pick')

.github/workflows/cicd-pull-request.yml

@@ -12,6 +12,11 @@ env:
   BASE_BRANCH: origin/main
   GO_VERSION: "1.24"
 
+permissions:
+  contents: read
+    actions: write
+    pull-requests: read
+
 jobs:
   trigger-mode:
     name: trigger mode

.github/workflows/cicd-push.yml

@@ -12,6 +12,10 @@ env:
   BASE_BRANCH: origin/main
   GO_VERSION: "1.24"
 
+permissions:
+  contents: read
+    actions: write
+
 jobs:
   trigger-mode:
     runs-on: ubuntu-latest

.github/workflows/codeql.yml

@@ -10,6 +10,10 @@ env:
   BASE_BRANCH: origin/main
   GO_VERSION: "1.24"
 
+permissions:
+  contents: read
+    security-events: write
+
 jobs:
   trigger-mode:
     runs-on: ubuntu-latest

.github/workflows/create-branch.yml

@@ -3,6 +3,9 @@ name: Create Release Branch Message
 on:
   create:
 
+permissions:
+  contents: write
+
 run-name: Create Release Branch
 
 jobs:

.github/workflows/e2e-fault.yml

@@ -56,6 +56,9 @@ run-name: fault:${{ inputs.PRE_VERSION }} to ${{ inputs.VERSION }} ${{ inputs.CL
 env:
   GH_TOKEN: ${{ github.token }}
 
+permissions:
+  contents: read
+
 jobs:
   check:
     runs-on: ubuntu-latest