CI: add least-privilege permissions to GitHub Actions workflows

.github/actions/setup-node/action.yml

@@ -14,7 +14,7 @@ runs:
       with:
         node-version: ${{ inputs.node-version }}
     - name: Cache Dependencies
-      uses: actions/cache@v2
+      uses: actions/cache@v4
       with:
         path: ./node_modules
         key: ${{ runner.os }}-${{ inputs.node-version }}-modules-${{ hashFiles('**/yarn.lock') }}

.github/workflows/docs.yml

@@ -10,14 +10,18 @@ concurrency:
   group: ${{ github.ref }}-${{ github.workflow }}
   cancel-in-progress: true
 
+permissions:
+  actions: write
+  contents: read
+
 jobs:
   build-docs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
       - uses: ./.github/actions/setup-node
       - name: Cache .docz folder
-        uses: actions/cache@v2
+        uses: actions/cache@v4
         with:
           path: ./.docz
           key: docz-${{ matrix.node }}-gatsby-v1-${{ github.run_id }}

.github/workflows/lint.yml

@@ -6,6 +6,9 @@ concurrency:
   group: ${{ github.ref }}-${{ github.workflow }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest

.github/workflows/size-limit.yml

@@ -13,6 +13,9 @@ concurrency:
   group: ${{ github.ref }}-${{ github.workflow }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   size:
     runs-on: ubuntu-latest

.github/workflows/unit.yml

@@ -6,6 +6,9 @@ concurrency:
   group: ${{ github.ref }}-${{ github.workflow }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   unit:
     runs-on: ubuntu-latest