ci: Add GitHub token permissions for workflows (#61065)

Signed-off-by: Varun Sharma <varunsh@stepsecurity.io>

.github/workflows/CI.yml

@@ -1,6 +1,9 @@
 name: CI
 on: pull_request
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest

.github/workflows/UpdateCodeowners.yml

@@ -10,6 +10,9 @@ on:
     - cron: "5 8 * * 1"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   update:
     runs-on: ubuntu-latest

.github/workflows/ghostbuster.yml

@@ -11,8 +11,14 @@ on:
         required: false
         default: "false"
 
+permissions:
+  contents: read
+
 jobs:
   ghostbust:
+    permissions:
+      contents: write  # for Git to git push
+      pull-requests: write  # for peter-evans/create-pull-request to create a PR
     runs-on: ubuntu-latest
     if: github.repository == 'DefinitelyTyped/DefinitelyTyped'
 

.github/workflows/lint-md.yml

@@ -3,6 +3,9 @@ on:
   pull_request:
     paths:
       - '**.md'
+permissions:
+  contents: read
+
 jobs:
   lint-md:
     runs-on: ubuntu-latest

.github/workflows/support-window.yml

@@ -10,8 +10,13 @@ on:
   # Manually, when TypeScript is released
   # https://docs.github.com/en/actions/managing-workflow-runs/manually-running-a-workflow
   workflow_dispatch:
+permissions:
+  contents: read
+
 jobs:
   support-window:
+    permissions:
+      contents: write  # for Git to git push
     if: github.repository == 'DefinitelyTyped/DefinitelyTyped'
     runs-on: ubuntu-latest
     steps: