[chore] set permissions to read explicitly #13036

	# This GitHub action is used to compare API state snapshots of Main
	# to Head of the PR in order to validate releases are not breaking
	# backwards compatibility.
	#
	# This GitHub action will fail if there are incompatible changes.
	#
	name: "Inform Incompatible PRs"
	on:
	pull_request:
	branches:
	- main

	permissions:
	contents: read

	jobs:
	Check-Compatibility:
	runs-on: macos-latest
	env:
	BASE_REF: ${{ github.base_ref }}
	HEAD_REF: ${{ github.head_ref }}
	steps:

	- name: Checkout-Main
	uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
	with:
	ref: ${{ github.base_ref }}
	path: ${{ github.base_ref }}

	- name: Checkout-HEAD
	uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
	with:
	path: ${{ github.head_ref }}

	- name: Setup Go
	uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
	with:
	go-version: ~1.21.5

	# Generate apidiff states of Main
	- name: Generate-States
	run: \|
	cd $BASE_REF
	make apidiff-build

	# Compare apidiff states of Main with PR
	- name: Compare-States
	env:
	CI: true
	COMPARE_OPTS: -d "../${{ github.base_ref }}/internal/data/apidiff"
	run: \|
	cd $HEAD_REF
	make apidiff-compare

	# Fail GitHub Action if there are incompatible changes
	- name: Check-States
	env:
	CI: true
	COMPARE_OPTS: -d "../${{ github.base_ref }}/internal/data/apidiff" -c
	run: \|
	cd $HEAD_REF
	make apidiff-compare

Provide feedback