Add Permissions

.github/workflows/pr.yaml

@@ -1,6 +1,9 @@
 name: Pull Request Checks
 
-on: [ push ]
+on:
+  pull_request:
+    branches:
+      - main
 
 jobs:
   code-quality:

.github/workflows/release-staging.yaml

@@ -1,7 +1,9 @@
 name: Release on Staging
 
 on:
-  push:
+  pull_request:
+    types:
+      - closed
     branches:
       - main
 
@@ -14,5 +16,8 @@ jobs:
     uses: ./.github/workflows/test.yaml
   publish:
     name: Publish staging release
+    permissions:
+      id-token: write
+      pages: write
     uses: ./.github/workflows/publish-test.yaml
     needs: [code-quality, test]

.github/workflows/release.yaml

@@ -8,4 +8,6 @@ on:
 jobs:
   publish:
     name: Publish release
+    permissions:
+      id-token: write
     uses: ./.github/workflows/publish.yaml

.github/workflows/test.yaml

@@ -5,7 +5,6 @@ on:
 
 jobs:
   unit-test:
-
     runs-on: ubuntu-latest
     strategy:
       matrix: