From f3bd663faf2235ca31b99679a6a35f0496dfb3b8 Mon Sep 17 00:00:00 2001
From: Evgeny Vereshchagin <evvers@ya.ru>
Date: Thu, 23 Jun 2022 14:09:36 +0000
Subject: [PATCH] ci: set top-level permissions as well

It should turn on the "restricted" mode by default regardless of
whether the global setting is on or not. New jobs in this action
should have to overwrite it explicitly to gain write access in any
way.

It should also make the action consistent with the other actions
writing various stuff like 'labeler' and 'codeql'.
---
 .github/workflows/issue_labeler.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/issue_labeler.yml b/.github/workflows/issue_labeler.yml
index c4143037ce..64774e67cc 100644
--- a/.github/workflows/issue_labeler.yml
+++ b/.github/workflows/issue_labeler.yml
@@ -5,6 +5,9 @@ on:
   issues:
     types: [ opened ]
 
+permissions:
+  contents: read
+
 jobs:
   label-component:
     runs-on: ubuntu-22.04