[security good practice] GitHub Action workflow, secrets.GITHUB_TOKEN now restricted by default (was permissive)

[danielweck]

Please update your GitHub Action workflow YAML to include the permissions key and explicitly specify the read/write access rules your jobs actually require:

https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token

https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions

[danielweck]

Relevant code:

ts-toolkit/.github/workflows/size.yml

Lines 8 to 12 in 659a3b2

	steps:
	- uses: actions/checkout@v1
	- uses: andresz1/size-limit-action@v1
	with:
	github_token: ${{ secrets.GITHUB_TOKEN }}

[danielweck]

In the Thorium project we need to create / delete / publish releases, and create / delete Git release tags. This is our GITHUB_TOKEN YAML configuration (as restrictive as possible):

https://github.com/edrlab/thorium-reader/blob/9d2bf56c181ec3da9634d30c12efdf067313efac/.github/workflows/main.yml#L9-L27