chore: Add permissions for workflows requiring GITHUB_TOKEN (#2971)

* Add permissions for workflows requiring GITHUB_TOKEN

* Write deployments permissions

* Switch deployments with content permission event

* Add permission blocks for PR Quality Reporting

* Move permission block to the root level

* Add content write permissions for gh-pages

---------

Co-authored-by: Nickii Miaro <miaronkirote@gmail.com>
Co-authored-by: Gavin Barron <gavinbarron@microsoft.com>

.github/workflows/pr-clean-deployments.yml

@@ -8,6 +8,10 @@ on:
     types: [closed]
     branches: [main, release/**, next/**]
 
+permissions:
+  pull-requests: write
+  contents: write
+
 jobs:
   cleanup:
     if: "contains(github.event.pull_request.labels.*.name, 'Build: Storybook') || contains(github.event.pull_request.labels.*.name, 'Build: React Contoso')"

.github/workflows/pr-reporting.yml

@@ -6,11 +6,15 @@ on:
     types:
       - completed
 
+permissions:
+  pull-requests: write
+
 jobs:
   pr_report:
     runs-on: ubuntu-latest
     env:
       GH_TOKEN: ${{ github.token }}
+
     steps:
       # added to work around missing .git repo wanted by gh cli
       - uses: actions/checkout@v4

.github/workflows/pr-storybook.yml

@@ -8,6 +8,10 @@ on:
     types: [opened, labeled, synchronize, reopened]
     branches: [main, release/**, next/**]
 
+permissions:
+  pull-requests: write
+  contents: write
+
 jobs:
   storybook:
     if: "contains(github.event.pull_request.labels.*.name, 'Build: Storybook')"

.github/workflows/pr-test-app.yml

@@ -8,6 +8,10 @@ on:
     types: [opened, labeled, synchronize, reopened]
     branches: [main, release/**, next/**]
 
+permissions:
+  pull-requests: write
+  contents: write
+
 jobs:
   react-contoso:
     if: "contains(github.event.pull_request.labels.*.name, 'Build: React Contoso')"

.github/workflows/pr.yml

@@ -9,6 +9,9 @@ on:
   pull_request:
     branches: [main, release/**, next/**]
 
+permissions:
+  pull-requests: write
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/project-automation.yml

@@ -5,9 +5,14 @@ on:
     types:
       - opened
 
+permissions:
+  issues: write
+  repository-projects: read
+
 jobs:
   track_issue:
     runs-on: ubuntu-latest
+
     steps:
       - name: Get project data
         env:
@@ -32,8 +37,8 @@ jobs:
             }' -f org=$PROJECT_ORGANIZATION -F number=$PROJECT_NUMBER > project_data.json
 
           echo 'PROJECT_ID='$(jq '.data.organization.projectNext.id' project_data.json) >> $GITHUB_ENV
-  
-      - name: Add issue to project        
+
+      - name: Add issue to project
         env:
           GITHUB_TOKEN: ${{ secrets.PROJECT_ACCESS_TOKEN }}
           ISSUE_ID: ${{ github.event.issue.node_id }}
@@ -43,4 +48,4 @@ jobs:
               addProjectNextItem(input: {projectId: $project, contentId: $issue}) { 
                 projectNextItem { id }  
               } 
-            }' -f project=$PROJECT_ID -f issue=$ISSUE_ID
+            }' -f project=$PROJECT_ID -f issue=$ISSUE_ID

.github/workflows/push-preview-release.yml

@@ -6,6 +6,10 @@ on:
   push:
     tags: ['v3.*-preview.*', 'v3.*-rc.*']
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   version:
     runs-on: ubuntu-latest

.github/workflows/push-release.yml

@@ -6,6 +6,8 @@ name: Release latest
 on:
   push:
     tags: ['v3.*']
+permissions:
+  contents: write
 
 jobs:
   version:

.github/workflows/storybook.yml

@@ -10,6 +10,9 @@ on:
   push:
     branches: [main]
 
+permissions:
+  contents: write
+
 jobs:
   build:
     runs-on: ubuntu-latest