Be explicit about actions: read to download artifacts

Author: benbz

.github/workflows/templates-dyff-comment.yml

@@ -9,11 +9,13 @@ on:
     types:
     - completed
 
+permissions:
+  actions: read
+  pull-requests: write
+
 jobs:
   manage-comment:
     runs-on: ubuntu-latest
-    permissions:
-      pull-requests: write
     if: github.event.workflow_run.conclusion == 'success'
     steps:
     - name: Download dyff of templates

newsfragments/594.internal.md

@@ -0,0 +1 @@
+CI: allow dyff job to work on forks.