tree 628b075603cea6923b1a78c9c2dfe890bfd648d6
parent 289d91426ecf609824cca459af8f3bd3a8b1a2c8
author Pedro Kaj Kjellerup Nacht <pnacht@google.com> 1699461034 -0800
committer Copybara-Service <copybara-worker@google.com> 1699461351 -0800

Add top-level permissions to cherry-picker and remove-labels.yml

Fixes #20086.

As described in the issue, this PR adds read-only permissions to bazel's workflows that don't yet have them. This reduces the risk of supply-chain attacks via the project's CI/CD infrastructure.

My understanding is that `cherry-picker.yml` does not require any additional permissions since everything done by `bazelbuild/continuous-integration/actions/cherry_picker` uses the declared `GH_TOKEN` instead of the workflow's default `GITHUB_TOKEN`. If I'm mistaken, let me know and I'll happy fix the PR.

Closes #20087.

PiperOrigin-RevId: 580542813
Change-Id: Ib45164ea8d9c0aa583e91d316ad2b552f3c9b5b7