Feature: Restricted Permissions

Restricted Permissions

Included in v0.0.20

GitHub introduced permissions for GITHUB_TOKEN which enables one to restrict tokens to just the necessary permissions.

check-spelling has a couple of distinct phases that have differing requirements.

It's better from a security perspective to use "least privilege".

contents: read -- to read the repository (to check it out) -- for a pull_request_target, this may include untrusted content (the merge)
pull-requests: read -- to determine if this push event should be skipped in favor of a related pull_request_target event.

contents: write -- if it's commenting on a commit (i.e. on: push)
pull-requests: write -- if it's commenting on a PR (i.e. on: pull_request_target)