Add explicit workflow permissions

.github/workflows/issues-auto-manager.yml

@@ -7,6 +7,10 @@ on:
   issue_comment:
     types: [created]
 
+permissions:
+  contents: read
+  issues: write
+
 jobs:
   label-on-content:
     name: 🏷️ Label Issues by Content

.github/workflows/issues-updates-on-merge.yml

@@ -6,6 +6,10 @@ on:
       - staging
       - release
 
+permissions:
+  contents: read
+  issues: write
+
 jobs:
   # This runs commits to staging/release, reading the commit messages. Check `pr-auto-manager.yml`:`update-linked-issues` for PR-linked updates.
   update-linked-issues:

.github/workflows/job-close-stale.yml

@@ -6,6 +6,11 @@ on:
   schedule:
     - cron: '0 0 * * *' # Runs every day at midnight UTC
 
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
 jobs:
   mark-inactivity:
     name: ⏳ Mark Issues/PRs without Activity

.github/workflows/on-close-handler.yml

@@ -6,6 +6,11 @@ on:
   pull_request_target:
     types: [closed]
 
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
 jobs:
   remove-labels:
     name: 🗑️ Remove Pending Labels on Close

.github/workflows/on-open-handler.yml

@@ -6,6 +6,11 @@ on:
   pull_request_target:
     types: [opened]
 
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
 jobs:
   label-maintainer:
     name: 🏷️ Label if Author is a Repo Maintainer

.github/workflows/pr-auto-manager.yml

@@ -6,6 +6,10 @@ on:
   pull_request_review_comment:
     types: [created]
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   label-by-size:
     name: 🏷️ Label PR by Size
@@ -75,7 +79,7 @@ jobs:
     name: 🗑️ Remove Stale Label on Comment
     runs-on: ubuntu-latest
     # Only runs when this is not done by the github actions bot
-    if: github.actor != 'github-actions[bot]'
+    if: github.event_name == 'pull_request_review_comment' && github.actor != 'github-actions[bot]'
 
     steps:
       - name: Remove Stale Label
@@ -95,6 +99,12 @@ jobs:
     # Run, even if the previous jobs were skipped/failed
     if: always()
 
+    # Override permissions, as this needs to write a check
+    permissions:
+      checks: write
+      contents: read
+      pull-requests: read
+
     steps:
       - name: Check Merge Blocking
         # GitHub Script

.github/workflows/pr-check-merge-conflicts.yaml

@@ -7,6 +7,10 @@ on:
   pull_request_target:
     types: [synchronize]
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   check-merge-conflicts:
     name: ⚔️ Check Merge Conflicts