chore(ci): More workflow permission changes (#11394)

Working towards have the minimum permissions in our CI workflows.

Author: Josh-Walker-GM

.github/workflows/check-changelog.yml

@@ -19,6 +19,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   check-changesets:
     name: 📝 Check changesets

.github/workflows/check-create-redwood-app.yml

@@ -10,6 +10,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   check-create-redwood-app:
     name: Check create redwood app

.github/workflows/check-test-project-fixture.yml

@@ -10,6 +10,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   detect-changes:
     if: github.repository == 'redwoodjs/redwood'
@@ -39,6 +41,8 @@ jobs:
     if: needs.detect-changes.outputs.code == 'true'
     name: Check test project fixture
     runs-on: ubuntu-latest
+    permissions:
+      actions: write
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/codeql-analysis.yml

@@ -26,13 +26,14 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  security-events: write
+permissions: {}
 
 jobs:
   analyze:
     name: 🔬 Analyze
     runs-on: ubuntu-latest
+    permissions:
+      security-events: write
 
     strategy:
       fail-fast: false