ci: update of files from global .github repo (#1163)

Author: asyncapi-bot

.github/workflows/automerge-for-humans-add-ready-to-merge-or-do-not-merge-label.yml

@@ -12,8 +12,15 @@ on:
     types:
       - created
 
+permissions: {}
+
 jobs:
   add-ready-to-merge-label:
+    name: Add ready-to-merge label
+    permissions:
+      issues: write # required to add labels and post comments on PR issues
+      pull-requests: write # required to read PR metadata from the issue pull_request URL
+      contents: read # required to compare PR branch commits against base
     if: >
       github.event.issue.pull_request && 
       github.event.issue.state != 'closed' && 
@@ -30,6 +37,9 @@ jobs:
         env:
           GITHUB_ACTOR: ${{ github.actor }}
         with:
+          # Use bot PAT, not the default GITHUB_TOKEN: events created by
+          # GITHUB_TOKEN do not trigger other workflows, so `Automerge For
+          # Humans` would never see the `labeled` event.
           github-token: ${{ secrets.GH_TOKEN }}
           script: |
             const prDetailsUrl = context.payload.issue.pull_request.url;
@@ -69,6 +79,10 @@ jobs:
             }
 
   add-do-not-merge-label:
+    name: Add do-not-merge label
+    permissions:
+      issues: write # required to add labels on PR issues
+      pull-requests: write # required to read PR metadata from the issue pull_request URL
     if: >
       github.event.issue.pull_request &&
       github.event.issue.state != 'closed' &&
@@ -82,6 +96,7 @@ jobs:
       - name: Add do-not-merge label
         uses: actions/github-script@v7
         with:
+          # Bot PAT so the `labeled` event can trigger downstream workflows.
           github-token: ${{ secrets.GH_TOKEN }}
           script: |
             github.rest.issues.addLabels({
@@ -91,6 +106,10 @@ jobs:
               labels: ['do-not-merge']
             })
   add-autoupdate-label:
+    name: Add autoupdate label
+    permissions:
+      issues: write # required to add labels on PR issues
+      pull-requests: write # required to read PR metadata from the issue pull_request URL
     if: >
       github.event.issue.pull_request && 
       github.event.issue.state != 'closed' && 
@@ -104,6 +123,7 @@ jobs:
       - name: Add autoupdate label
         uses: actions/github-script@v7
         with:
+          # Bot PAT so the `labeled` event can trigger the autoupdate workflow.
           github-token: ${{ secrets.GH_TOKEN }}
           script: |
             github.rest.issues.addLabels({