No need to request escalated permissions for GITHUB_TOKEN

[jeffwidman]

Several of these job steps that use GITHUB_TOKEN are read-only
operations, so they don't need elevated permissions for the
GITHUB_TOKEN.

And the jobs that do need elevated permissions we're already using a
PAT, so it's not even using the GITHUB_TOKEN.

So no need for any custom permissions on the GITHUB_TOKEN at all.

[landongrindheim]

Makse sense to me! I trust you'll monitor these workflows to ensure the permissions changes have had the intended effect 😄

[Nishnha]

Should we also update the readme and remove the write permission in the example? https://github.com/dependabot/fetch-metadata#enabling-auto-merge

[jeffwidman]

Should we also update the readme and remove the write permission in the example? https://github.com/dependabot/fetch-metadata#enabling-auto-merge

Thanks for looking deeper in your review to check for that. Merging a PR affects both the state of the PR and the state of the underlying repo, so according to one of the gh maintainers both contents: write and pull-requests: write are necessary:

• What permissions are needed to use OOTB GITHUB_TOKEN with gh pr merge --squash --auto cli/cli#6379 (comment)
• Allow enabling auto-merge from GitHub Actions cli/cli#6695 (comment)