Set permissions for GitHub actions (cheeriojs#2453)

Author: neilnaveen

.github/workflows/benchmark.yml

@@ -10,6 +10,9 @@ env:
   FORCE_COLOR: 2
   NODE: 16
 
+permissions:
+  contents: read
+
 jobs:
   benchmark:
     runs-on: ubuntu-latest

.github/workflows/ci.yml

@@ -10,8 +10,14 @@ env:
   FORCE_COLOR: 2
   NODE_COV: 16 # The Node.js version to run coveralls on
 
+permissions:
+  contents: read
+
 jobs:
   run:
+    permissions:
+      checks: write  # for coverallsapp/github-action to create new checks
+      contents: read  # for actions/checkout to fetch code
     name: Node ${{ matrix.node }}
     runs-on: ubuntu-latest
 

.github/workflows/lint.yml

@@ -10,6 +10,9 @@ env:
   FORCE_COLOR: 2
   NODE: 16
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest

.github/workflows/sponsors.yml

@@ -9,8 +9,14 @@ env:
   FORCE_COLOR: 2
   NODE: 16
 
+permissions:
+  contents: read
+
 jobs:
   fetch:
+    permissions:
+      contents: write  # for peter-evans/create-pull-request to create branch
+      pull-requests: write  # for peter-evans/create-pull-request to create a PR
     runs-on: ubuntu-latest
 
     steps: