Declare workflow permissions (#482)

.github/workflows/draft-release.yml

@@ -13,6 +13,10 @@ on:
           - 'minor'
           - 'patch'
 
+permissions:
+  contents: 'read'
+  pull-requests: 'write'
+
 jobs:
   draft-release:
     uses: 'google-github-actions/.github/.github/workflows/draft-release.yml@v3' # ratchet:exclude

.github/workflows/release.yml

@@ -6,6 +6,10 @@ on:
       - 'main'
       - 'release/**/*'
 
+permissions:
+  contents: 'read'
+  packages: 'write'
+
 jobs:
   release:
     uses: 'google-github-actions/.github/.github/workflows/release.yml@v3' # ratchet:exclude

.github/workflows/test.yml

@@ -33,6 +33,10 @@ defaults:
   run:
     shell: 'bash'
 
+permissions:
+  contents: 'read'
+  statuses: 'write'
+
 jobs:
   unit:
     name: 'unit'