{CI} Tighten GHA workflows' permission

.github/workflows/AddPRComment.yml

@@ -1,5 +1,5 @@
 on:
-  pull_request_target:
+  pull_request:
     types: [opened]
     branches:
       - dev

.github/workflows/AzdevLinter.yml

@@ -1,6 +1,6 @@
 name: GH Check CLI Linter
 on:
-  pull_request_target:
+  pull_request:
     types: [opened, labeled, unlabeled, synchronize]
     branches:
       - dev

.github/workflows/AzdevStyle.yml

@@ -1,6 +1,6 @@
 name: GH Check CLI Style
 on:
-  pull_request_target:
+  pull_request:
     types: [opened, labeled, unlabeled, synchronize]
     branches:
       - dev

.github/workflows/BlockPRMerge.yml

@@ -1,15 +1,18 @@
 name: Block PR merging on blocked labels
 
 on:
-  pull_request_target:
+  pull_request:
     types: [labeled, unlabeled]
     branches:
       - dev
       - release
 
+permissions: {}
+
 jobs:
   block-merge:
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
       - name: Check blocked labels
         uses: actions/github-script@v7

.github/workflows/CCOA.yml

@@ -1,19 +1,21 @@
 name: CCOA
 
 on:
-  pull_request_target:
+  pull_request:
     types:
       - opened
       - reopened
     branches:
       - dev
 
-permissions:
-  pull-requests: write
+permissions: {}
 
 jobs:
   add_label_and_comment:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+      issues: write
 
     steps:
       - name: Check current date securely

.github/workflows/GitHookNotice.yml

@@ -1,6 +1,6 @@
 name: Git Hook Notice
 on:
-  pull_request_target:
+  pull_request:
     types: [opened]
     branches:
       - dev
@@ -11,18 +11,16 @@ jobs:
   git-hook-notice:
     runs-on: ubuntu-latest
     permissions:
-      pull-requests: write
+      contents: read
     name: Introduce git hook in developer env
     steps:
       - name: Checkout git hook notice message
         uses: actions/checkout@v4
         with:
           sparse-checkout: |
             .github/template/git-hooks-note.md
-      - name: Comment on pull request
-        uses: mshick/add-pr-comment@v2
-        with:
-           repo-token: ${{ secrets.GITHUB_TOKEN }}
-           message-id: gitHookNoticeComment
-           message-path: |
-            .github/template/git-hooks-note.md 
+      - name: Show git hook notice
+        run: |
+          echo "::group::Git hook notice"
+          cat .github/template/git-hooks-note.md
+          echo "::endgroup::"