[Idea] Setting to extend workflow permissions

[Ole Wunschmann (OleWunschmann)]

Idea Description

Repositories can add custom jobs to existing workflows, but those jobs are limited to the permissions already defined by AL-Go.

Example:
The PullRequestHandler.yaml workflow has the permission pull-requests: read.
Therefore, there is no straightforward way to add a custom job that posts comments on a pull request.

A current workaround is to use an additional GitHub App with the required permissions.

Idea:
Introduce a new WorkflowPermissions setting similar to the setting for schedules.
It could be an object containing custom permissions as properties, for example:

{
  "pull-requests": "write"
}

The update workflow would read this setting and replace or update the permissions for each specified property.

There could also be a restriction that this setting may only increase permissions and permission reductions would be ignored.
For example, if a workflow has pull-requests: read, it must not be possible to change it to pull-requests: none.

Contribution (Optional)

• I would be open to contributing to this idea (implementation, documentation, testing, etc.)