add default permissions block in trigger-breaking-change-alert config

[jameslamb]

Description

Follow-up to #2435

Adds a default permissions: {} block in the trigger-breaking-change-alert GitHub Actions configuration. This change reduces the risk of unnecessary permissions being granted to that workflow, and standardizes with all other RAPIDS repos (rapidsai/shared-workflows#560).

Checklist

• I am familiar with the Contributing Guidelines.
• New or existing tests cover these changes.
• The documentation is up to date with these changes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 000bc078-9da8-44ae-9545-80a3bbb3b525

📥 Commits

Reviewing files that changed from the base of the PR and between 6215ecd and ac6e3d5.

📒 Files selected for processing (1)

• .github/workflows/trigger-breaking-change-alert.yaml

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated GitHub Actions workflow configuration to enhance security settings for pull request handling.

Walkthrough

This PR adds a workflow-level empty permissions: {} configuration to the trigger-breaking-change-alert.yaml workflow file. This restricts the GitHub token's default permissions, applying a security hardening practice to the pull request target trigger.

Changes

Workflow Permissions Configuration

Layer / File(s)	Summary
Empty permissions restriction for pull_request_target .github/workflows/trigger-breaking-change-alert.yaml	The workflow now declares an empty permissions: {} block at the top level, restricting GitHub token permissions for the pull_request_target trigger.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• rapidsai/rmm#2435: Both PRs modify the same workflow file and apply related permission configuration changes for the breaking-change alert job.

Suggested labels

non-breaking, improvement

Suggested reviewers

• jakirkham
• KyleFromNVIDIA

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: adding a default permissions block to the trigger-breaking-change-alert workflow configuration.
Description check	✅ Passed	The description is clearly related to the changeset, providing context about the purpose of adding permissions block, referencing a follow-up issue, and explaining standardization with other repositories.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[jakirkham]

Thanks James! 🙏

[bdice]

/merge