scope down permissions

.github/workflows/eval-pr-comment.yml

@@ -13,6 +13,10 @@ jobs:
     if: >
       github.event.workflow_run.event == 'pull_request' &&
       github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read # for downloading artifacts
+      pull-requests: write # for posting PR comment
 
     steps:
       - name: Download Eval Metrics
@@ -46,4 +50,5 @@ jobs:
           issue-number: ${{ github.event.pull_request.number }}
           body: |
             ### Evaluation Metrics
-            ${{steps.csv-table-output.outputs.markdown-table}}
+            ${{steps.csv-table-output.outputs.markdown-table}}
+          reactions: rocket