Fixes #2772. This PR sets top-level read-only permissions on all CI/CD workflows. Jobs that require additional permissions (`stale.yml` and `pr-comment.yml`) are given them at the job-level. I made more significant changes in `pr-comment.yml`. It is vulnerable to code injection, since it runs files controlled by the PR author (`requirements.txt` and `scripts/list_missing_entries.py`, taken from the PR). I have therefore modified the workflow to checkout those files from the base branch instead, ensuring we're running trusted versions of those files. And in order to minimize the code that has access to the `issues/pull-requests: write` permissions, I have separated the workflow into two sequential jobs: 1. `define-comment`, which is unprivileged and does almost everything 2. `write-comment`, which has those additional permissions and uses them to perform the very last step of actually writing the comment on the PR. --------- Signed-off-by: Pedro Kaj Kjellerup Nacht <pnacht@google.com> Co-authored-by: rtobar <rtobarc@gmail.com>

Uh oh!

Uh oh!