Scope down workflow permissions

[jaykorean]

Summary

Followed instruction per https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#defining-access-for-the-github_token-scopes

It turns out that we did not need any of these except Metadata: read.

Before

GITHUB_TOKEN Permissions
  Actions: write
  Attestations: write
  Checks: write
  Contents: write
  Deployments: write
  Discussions: write
  Issues: write
  Metadata: read
  Packages: write
  Pages: write
  PullRequests: write
  RepositoryProjects: write
  SecurityEvents: write
  Statuses: write

After

GITHUB_TOKEN Permissions
  Metadata: read

Test Plan

GitHub Actions triggered by this PR

[facebook-github-bot]

@jaykorean has imported this pull request. If you are a Meta employee, you can view this diff on Phabricator.

[facebook-github-bot]

@jaykorean has updated the pull request. You must reimport the pull request before landing.

[facebook-github-bot]

@jaykorean has imported this pull request. If you are a Meta employee, you can view this diff on Phabricator.

[cbi42]

The nightly jobs are probably not triggered by this PR?

[jaykorean]

@cbi42 Correct. It is scheduled by cron (cron: 0 9 * * * - 9AM every day) or can be triggered manually (workflow_dispatch).

[cbi42]

@cbi42 Correct. It is scheduled by cron (cron: 0 9 * * * - 9AM every day) or can be triggered manually (workflow_dispatch).

I see. We can monitor the next run just to make sure.

[facebook-github-bot]

@jaykorean merged this pull request in 0082907.