chore: Add permissions to all workflows (#12)

Author: erezrokah

.github/.kodiak.toml

@@ -0,0 +1,17 @@
+
+version = 1
+
+[approve]
+auto_approve_usernames = ["cq-bot"]
+
+[merge.message]
+body = "pull_request_body"
+cut_body_after = "Use the following steps to ensure your PR is ready to be reviewed"
+cut_body_and_text = true
+cut_body_before = "<!-- 🎉 Thank you for making CloudQuery awesome by submitting a PR 🎉 -->"
+title = "pull_request_title"
+
+[merge]
+blocking_labels = ["wip", "no automerge"]
+notify_on_conflict = false
+priority_merge_label = "priority merge"

.github/renovate.json5

@@ -0,0 +1,9 @@
+{
+  extends: ['github>cloudquery/.github//.github/renovate-node-default.json5'],
+  packageRules: [
+    {
+      matchPackageNames: ["*"],
+      groupName: "everything",
+    },
+  ],
+}

.github/workflows/publish-rc.yml

@@ -3,7 +3,8 @@ name: Publish release-candidate npm package
 on:
   pull_request:
     types: [opened, reopened, synchronize]
-
+permissions:
+  contents: read
 jobs:
   publish_rc:
     if: contains(github.event.pull_request.labels.*.name, 'release-candidate')

.github/workflows/publish.yml

@@ -4,7 +4,8 @@ on:
   push:
     branches:
       - main
-
+permissions:
+  contents: read
 jobs:
   publish:
     runs-on: ubuntu-latest