workflows: Add permissions. (#305)

Add permissions to the workflows across mu_devops. This includes the
workflows sync'd across repositories, and workflows used in mu_devops
itself.


With MU_BASECORE's Settings -> Code and automation -> Actions -> General
-> Workflow permissions set to "Read repository contents and packages
permissions" selected, I had no failures, with the following tested:

.github/workflows
- **AutoMerger.yml - Untested**
- FileSyncer.yml - Tested
- IssueAssignment.yml - Tested
- IssueTriager.yml - Tested
- LabelSyncer.yml - Tested
- Labeler.yml - Tested
- ReleaseDrafter.yml - Tested

.sync/workflows/leaf
- **auto-approve.yml - Untested**
- **auto-merge.yml - Untested**
- issue-assignment.yml - Tested through IssueAssignment.yml
- label-issues.yml - Tested through Labeler.yml
- label-sync.yml - Tested through LabelSyncer.yml
- pull-request-formatting-validator.yml - Tested Directly
- release-draft.yml - Tested through ReleaseDrafter.yml
- scheduled-maintenance.yml - Tested Directly
- stale.yml - Tested Directly
- **submodule-release-update.yml - Untested**
- triage-issues.yml - Tested

Author: Javagedes

.github/workflows/AutoMerger.yml

@@ -17,6 +17,11 @@ jobs:
     name: Merge
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
+
     # The action cannot take multiple authors right now, so call with each author
     # separately.
     strategy:

.github/workflows/FileSyncer.yml

@@ -21,6 +21,11 @@ jobs:
     name: Repo File Sync
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: write
+      pull-requests: write
+      actions: write
+
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v4

.github/workflows/IssueAssignment.yml

@@ -15,6 +15,11 @@ jobs:
   adjust-labels:
     name: Adjust Issue Labels
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      issues: write
+
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/IssueTriager.yml

@@ -24,6 +24,9 @@ jobs:
     strategy:
       matrix:
         template: [ bug_report.yml, documentation_request.yml, feature_request.yml ]
+    
+    permissions:
+      issues: write
 
     steps:
       - uses: actions/checkout@v4

.github/workflows/LabelSyncer.yml

@@ -25,6 +25,9 @@ jobs:
     name: Sync
     runs-on: ubuntu-latest
 
+    permissions:
+      issues: write
+
     steps:
       - name: Sync Labels
         uses: EndBug/label-sync@v2

.github/workflows/Labeler.yml

@@ -32,6 +32,10 @@ jobs:
     name: Label Based on Messages
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+      pull-requests: write
+
     steps:
       - name: Apply Labels Based on PR File Paths
         uses: actions/[email protected]

.github/workflows/ReleaseDrafter.yml

@@ -46,6 +46,10 @@ jobs:
     name: Update Release Draft
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: write
+      pull-requests: write
+
     steps:
       - name: Download Version Information
         id: download_ver_info

.sync/Version.njk

@@ -30,7 +30,7 @@
 #}
 
 {# The git ref value that files dependent on this repo will use. #}
-{% set mu_devops = "v9.0.1" %}
+{% set mu_devops = "v9.1.1" %}
 
 {# The latest Project Mu release branch value. #}
 {% set latest_mu_release_branch = "release/202302" %}

.sync/workflows/leaf/auto-approve.yml

@@ -25,6 +25,10 @@ on:
 
 jobs:
   approval_check:
+
+    permissions:
+      pull-requests: write
+
     if: |
       github.event.pull_request.user.login == 'dependabot[bot]' || github.event.pull_request.user.login == 'uefibot'
     uses: microsoft/mu_devops/.github/workflows/AutoApprover.yml@{{ sync_version.mu_devops }}

.sync/workflows/leaf/auto-merge.yml

@@ -26,6 +26,12 @@ on:
 
 jobs:
   merge_check:
+
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
+
     if: |
       github.event.pull_request.user.login == 'dependabot[bot]' || github.event.pull_request.user.login == 'uefibot'
     uses: microsoft/mu_devops/.github/workflows/AutoMerger.yml@{{ sync_version.mu_devops }}