[gha] Make workflow permissions uniform (#4311)

Author: imnasnainaec

.github/workflows/backend.yml

@@ -15,7 +15,7 @@ concurrency:
   cancel-in-progress: true
   group: ${{ github.workflow }}-${{ github.ref_protected && github.run_id || github.event.pull_request.number }}
 
-permissions: # added using https://github.com/step-security/secure-workflows
+permissions:
   contents: read
 
 jobs:

.github/workflows/codeql.yml

@@ -12,7 +12,7 @@ concurrency:
   cancel-in-progress: true
   group: ${{ github.workflow }}-${{ github.ref_protected && github.run_id || github.event.pull_request.number }}
 
-permissions: # added using https://github.com/step-security/secure-workflows
+permissions:
   contents: read
 
 jobs:

.github/workflows/combine_deploy_image.yml

@@ -6,7 +6,7 @@ on:
     paths:
       - "deploy/**"
 
-permissions: # added using https://github.com/step-security/secure-workflows
+permissions:
   contents: read
 
 jobs:

.github/workflows/commit_message_check.yml

@@ -8,10 +8,12 @@ concurrency:
   cancel-in-progress: true
   group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
 
-permissions: # added using https://github.com/step-security/secure-workflows
+permissions:
   contents: read
-  pull-requests: write
 
 jobs:
   commit-message-lint:
+    permissions:
+      contents: read
+      pull-requests: write
     uses: sillsdev/FieldWorks/.github/workflows/CommitMessage.yml@28e9888c4c70a3af593b1b97b77954e04149059b

.github/workflows/database.yml

@@ -10,7 +10,7 @@ concurrency:
   cancel-in-progress: true
   group: ${{ github.workflow }}-${{ github.ref_protected && github.run_id || github.event.pull_request.number }}
 
-permissions: # added using https://github.com/step-security/secure-workflows
+permissions:
   contents: read
 
 jobs:

.github/workflows/frontend.yml

@@ -13,7 +13,7 @@ concurrency:
   cancel-in-progress: true
   group: ${{ github.workflow }}-${{ github.ref_protected && github.run_id || github.event.pull_request.number }}
 
-permissions: # added using https://github.com/step-security/secure-workflows
+permissions:
   contents: read
 
 jobs:

.github/workflows/installer.yml

@@ -16,7 +16,7 @@ concurrency:
   cancel-in-progress: true
   group: ${{ github.workflow }}-${{ github.ref_protected && github.run_id || github.event.pull_request.number }}
 
-permissions: # added using https://github.com/step-security/secure-workflows
+permissions:
   contents: read
 
 jobs:

.github/workflows/labeler.yml

@@ -4,6 +4,9 @@ name: "Pull Request Labeler"
 on:
   - pull_request_target
 
+permissions:
+  contents: read
+
 jobs:
   labeler:
     permissions:

.github/workflows/localization_check.yml

@@ -25,7 +25,7 @@ concurrency:
   cancel-in-progress: true
   group: ${{ github.workflow }}-${{ github.ref }}
 
-permissions: # added using https://github.com/step-security/secure-workflows
+permissions:
   contents: read
 
 jobs:

.github/workflows/maintenance.yml

@@ -10,7 +10,7 @@ concurrency:
   cancel-in-progress: true
   group: ${{ github.workflow }}-${{ github.ref_protected && github.run_id || github.event.pull_request.number }}
 
-permissions: # added using https://github.com/step-security/secure-workflows
+permissions:
   contents: read
 
 jobs: