fixup token permissions

.github/workflows/auto-merge.yml

@@ -4,12 +4,13 @@ on:
   pull_request:
     types: [labeled]
 
-permissions:
-  contents: write
-  pull-requests: write
+permissions: read-all
 
 jobs:
   automerge:
+    permissions:
+      contents: write
+      pull-requests: write
     uses: adoptium/.github/.github/workflows/pr-auto-merge.yml@main
     with:
       allowed-author: eclipse-temurin-bot

.github/workflows/code-freeze.yml

@@ -19,13 +19,14 @@ on:
   issue_comment:
     types: [created]
 
-permissions:
-  contents: write
-  pull-requests: write
+permissions: read-all
 
 jobs:
   # Check if the pull request target branch matches the required branch-regex?
   codefreeze_branch_check:
+    permissions:
+      contents: write
+      pull-requests: write
     uses: adoptium/.github/.github/workflows/code-freeze-regex-branch.yml@main
     with:
       branch-regex: "^main$"

.github/workflows/dependabot-auto-merge.yml

@@ -1,10 +1,11 @@
 name: Dependabot auto-merge
 on: pull_request_target
 
-permissions:
-  contents: write
-  pull-requests: write
+permissions: read-all
 
 jobs:
   dependabot:
+    permissions:
+      contents: write
+      pull-requests: write
     uses: adoptium/.github/.github/workflows/dependabot-auto-merge.yml@main

.github/workflows/test-pr.yml

@@ -11,6 +11,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: read-all
+
 jobs:
   generate-jobs:
     name: Generate Jobs

.github/workflows/updater.yml

@@ -5,6 +5,8 @@ on:
     # Runs every half hour
     - cron: "*/30 * * * *"
 
+permissions: read-all
+
 jobs:
   update_dockerfile:
     permissions: