🔒️ Restrict permissions on workflows part 2

Author: Poeschl

.github/workflows/addon-ci.yaml

@@ -8,8 +8,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
-permissions: read-all
-
 jobs:
 
   information:

.github/workflows/addon-deploy.yaml

@@ -16,8 +16,6 @@ concurrency:
   group: deploy
   cancel-in-progress: false
 
-permissions: read-all
-
 jobs:
   information:
     if: github.event_name == 'release'

.github/workflows/labels.yaml

@@ -12,8 +12,6 @@ on:
     paths:
       - .github/labels.yaml
 
-permissions: read-all
-
 jobs:
   labels:
     name: ♻️ Sync labels

.github/workflows/pr-labels.yaml

@@ -10,8 +10,6 @@ on:
       - synchronize
   workflow_call:
 
-permissions: read-all
-
 jobs:
   pr_labels:
     name: ✔️ Verify label

.github/workflows/pr-title.yaml

@@ -8,8 +8,6 @@ on:
       - edited
   workflow_call:
 
-permissions: read-all
-
 jobs:
   gitmoji-pr-title:
     name: ✔️ Verify title

.github/workflows/release-drafter.yaml

@@ -4,8 +4,6 @@ name: Release Drafter
 on:
   workflow_call:
 
-permissions: read-all
-
 jobs:
   update_release_draft:
     name: ✏️ Draft release

.github/workflows/repository-pr.yaml

@@ -4,8 +4,6 @@ name: Verify edge repository
 on:
   workflow_call:
 
-permissions: read-all
-
 jobs:
   lint-markdown:
     name: 🔎 MarkdownLint

.github/workflows/repository-update.yaml

@@ -16,12 +16,12 @@ concurrency:
   group: queue
   cancel-in-progress: false
 
-permissions: read-all
-
 jobs:
   publish:
     name: Publish add-on update
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: 🚀 Run Repository Updater
         uses: hassio-addons/repository-updater@v1

.github/workflows/workflows-pr.yaml

@@ -10,8 +10,6 @@ on:
       - synchronize
   workflow_dispatch:
 
-permissions: read-all
-
 jobs:
   lint-markdown:
     name: 🔎 MarkdownLint