Add explicit workflow permissions (#126)

Author: delatrie

.github/workflows/build.yml

@@ -9,6 +9,9 @@ on:
     branches:
       - 'main'
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     name: PHP ${{ matrix.php-version }} PHPUnit ${{matrix.phpunit-version}} on ${{ matrix.os }}

.github/workflows/labels-verify.yml

@@ -2,12 +2,15 @@ name: "Verify type labels"
 
 on:
   pull_request:
-    types: [ labeled, unlabeled ]
+    types: [opened, labeled, unlabeled, synchronize]
+
+permissions:
+  contents: read
 
 jobs:
   triage:
     runs-on: ubuntu-latest
     steps:
       - uses: zwaldowski/match-label-action@v6
         with:
-          allowed: 'type:bug,type:new feature,type:improvement,type:dependencies,type:internal,type:invalid'
+          allowed: 'type:bug,type:new feature,type:improvement,type:dependencies,type:internal,type:invalid,type:docs'