Add workflow permissions

.github/workflows/artdaq-build-single-pkg.yml

@@ -1,5 +1,8 @@
 name: Build Single Pkg Workflow
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:

.github/workflows/artdaq-develop-cpp-ci.yml

@@ -1,5 +1,8 @@
 name: build-develop
 
+permissions:
+  contents: read
+
 # Controls when the action will run. Workflow runs when manually triggered using the UI
 # or API.
 on:

.github/workflows/artdaq-format-single-pkg.yml

@@ -1,5 +1,8 @@
 name: Format Single Pkg Workflow
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:

.github/workflows/artdaq-test-single-pkg.yml

@@ -1,5 +1,8 @@
 name: Test Single Pkg Workflow
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:

.github/workflows/artdaq-tidy-single-pkg.yml

@@ -1,5 +1,8 @@
 name: Tidy Single Pkg Workflow
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:

.github/workflows/auto_approve.yml

@@ -1,5 +1,8 @@
 name: Auto approve
 
+permissions:
+  pull-requests: write
+
 on:
   workflow_dispatch:
     inputs:

.github/workflows/git-whitespace.yml

@@ -1,5 +1,8 @@
 name: Git Whitespace Check Workflow
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:

.github/workflows/track_new_issues.yml

@@ -1,4 +1,9 @@
 name: Add issue to project
+
+# Job doesn't use the default GITHUB_TOKEN
+permissions:
+  contents: read
+
 on:
   issues:
     types:

.github/workflows/track_new_prs.yml

@@ -1,4 +1,9 @@
 name: Add pull request to project
+
+# Job doesn't use the default GITHUB_TOKEN
+permissions:
+  contents: read
+
 on:
   pull_request:
     types: