chore(ci): address codeql alerts

.github/workflows/auto_add_reponame_labels.yml

@@ -7,7 +7,9 @@ on:
   pull_request:
     types:
       - opened
-
+permissions:
+  issues: write
+  pull-requests: write
 jobs:
   add_label:
     uses: CCBR/.github/.github/workflows/add_reponame_issue_label.yml@v0.2.0

.github/workflows/autoassig_milestone_to_issue.yml

@@ -4,6 +4,11 @@ on:
     types: [assigned, opened, reopened]
   pull_request:
     types: [assigned, opened, reopened]
+
+permissions:
+  issues: write
+  pull-requests: write
+
 jobs:
   milestone:
     runs-on: ubuntu-latest

.github/workflows/docs-mkdocs.yml

@@ -12,7 +12,9 @@ on:
       - "**.md"
       - .github/workflows/docs-mkdocs.yml
       - mkdocs.yml
-
+permissions:
+  contents: write
+  pages: write
 jobs:
   mkdocs:
     runs-on: ubuntu-latest

.github/workflows/draft-release.yml

@@ -11,7 +11,8 @@ on:
         required: false
         type: string
         default: ""
-
+permissions:
+  contents: write
 jobs:
   draft-release:
     runs-on: ubuntu-latest

.github/workflows/post-release.yml

@@ -4,7 +4,8 @@ on:
   release:
     types:
       - published
-
+permissions:
+  contents: write
 jobs:
   cleanup:
     runs-on: ubuntu-latest

.github/workflows/techdev-project.yml

@@ -7,7 +7,9 @@ on:
   pull_request:
     types:
       - opened
-
+permissions:
+  issues: read
+  pull-requests: read
 jobs:
   add-to-project:
     runs-on: ubuntu-latest

.github/workflows/user-projects.yml

@@ -7,7 +7,9 @@ on:
   pull_request:
     types:
       - assigned
-
+permissions:
+  issues: read
+  pull-requests: write
 jobs:
   add-to-project:
     uses: CCBR/.github/.github/workflows/auto-add-user-project.yml@v0.1.0