ci: set explicit strict permissions

Signed-off-by: Chawye Hsu <su+git@chawyehsu.com>

Author: chawyehsu

.github/workflows/ci.yml

@@ -8,6 +8,9 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test

.github/workflows/excavator.yml

@@ -1,15 +1,21 @@
+name: Excavator
+
 on:
   workflow_dispatch:
   schedule:
     # run every 4 hours
     - cron: '20 */4 * * *'
-name: Excavator
+
+permissions:
+  contents: write
+
 jobs:
   excavate:
     name: Excavate
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Excavate
         uses: ScoopInstaller/GithubActions@main
         env:

.github/workflows/issue_comment.yml

@@ -1,13 +1,20 @@
+name: Commented Pull Request
+
 on:
   issue_comment:
     types: [created]
-name: Commented Pull Request
+
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   pullRequestHandler:
     name: PullRequestHandler
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: PullRequestHandler
         uses: ScoopInstaller/GithubActions@main
         if: startsWith(github.event.comment.body, '/verify')

.github/workflows/issues.yml

@@ -1,13 +1,20 @@
+name: Issues
+
 on:
   issues:
     types: [opened, labeled]
-name: Issues
+
+permissions:
+  contents: read
+  issues: write
+
 jobs:
   issueHandler:
     name: IssueHandler
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: IssueHandler
         uses: ScoopInstaller/GithubActions@main
         if: github.event.action == 'opened' || (github.event.action == 'labeled' && contains(github.event.issue.labels.*.name, 'verify'))

.github/workflows/pull_request.yml

@@ -1,13 +1,20 @@
+name: Pull Requests
+
 on:
   pull_request:
     types: [opened]
-name: Pull Requests
+
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   pullRequestHandler:
     name: PullRequestHandler
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: PullRequestHandler
         uses: ScoopInstaller/GithubActions@main
         env: