ci: harden

After the release 3.1.0 release of eps1lon/actions-label-merge-conflict, documentation about how to harden the token was provided.
The action now uses the default GITHUB_TOKEN

Signed-off-by: Fernando Fernández <ferferga@hotmail.com>

.github/workflows/__automation.yml

@@ -8,10 +8,13 @@ jobs:
     name: Label conflicted PRs 🏷️⛔
     if: ${{ always() && !cancelled() }}
     runs-on: ubuntu-slim
+    permissions:
+      contents: read
+      pull-requests: write
 
     steps:
       - name: Check all PRs for merge conflicts and label them ⛔
         uses: eps1lon/actions-label-merge-conflict@0273be72a0bbd58fcd71d0d6c02c209b50d1e5e1 # v3.1.0
         with:
           dirtyLabel: "merge conflict"
-          repoToken: ${{ secrets.JF_BOT_TOKEN }}
+          repoToken: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/pull_request.yml

@@ -23,7 +23,9 @@ jobs:
     name: Automation 🎛️
     if: ${{ always() && !cancelled() && github.repository == 'jellyfin/jellyfin-vue' }}
     uses: ./.github/workflows/__automation.yml
-    secrets: inherit
+    permissions:
+      contents: read
+      pull-requests: write
 
   semantic-commits:
     if: ${{ always() && !cancelled() && github.repository == 'jellyfin/jellyfin-vue' }}

.github/workflows/push_release.yml

@@ -20,7 +20,9 @@ jobs:
     name: Automation 🎛️
     if: ${{ github.repository == 'jellyfin/jellyfin-vue' }}
     uses: ./.github/workflows/__automation.yml
-    secrets: inherit
+    permissions:
+      contents: read
+      pull-requests: write
 
   main:
     name: ${{ github.event_name == 'push' && 'Unstable 🚀⚠️' || 'Stable 🏷️✅' }}