Add least-privilege permissions blocks to three workflows that use
pull_request_target without explicit permission scoping:
- sync_renovate-changesets: contents:write + pull-requests:write
- sync_dependabot-changesets: contents:write + pull-requests:write
- sync_pull-requests-trigger: all none (only uploads artifacts)
These workflows run in the base repo context and have access to secrets.
Explicit permissions ensure the GITHUB_TOKEN is scoped to only what each
workflow needs, reducing blast radius if a guard is ever bypassed.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
Fredrik Adelöw
17c0551651