Set additional github token permissions

.github/workflows/genericx86-64-ext.yml

@@ -28,6 +28,13 @@ on:
   # Enable this push trigger on device repos
   # workflow_dispatch:
 
+permissions:
+      id-token: write # This is required for requesting the JWT #https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#requesting-the-access-token
+      actions: read # We are fetching workflow run results of a merge commit when workflow is triggered by new tag, to see if tests pass
+      pull-requests: write # Read is required to fetch the PR that merged, in order to get the test results. Write is required to create PR comments for workflow approvals.
+      packages: read
+      contents: read
+
 jobs:
   yocto:
     name: Yocto

.github/workflows/yocto-build-deploy.yml

@@ -186,6 +186,8 @@ jobs:
       id-token: write # This is required for requesting the JWT #https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#requesting-the-access-token
       actions: read # We are fetching workflow run results of a merge commit when workflow is triggered by new tag, to see if tests pass
       pull-requests: write # Read is required to fetch the PR that merged, in order to get the test results. Write is required to create PR comments for workflow approvals.
+      packages: read
+      contents: read
 
     env:
       automation_dir: "${{ github.workspace }}/balena-yocto-scripts/automation"