Merge pull request #48 from mitre/autoapproveandmerge_improvements

don't need contents permission on autoapproveandmerge workflow

Author: Amndeep7

.github/workflows/auto-approve-and-merge.yml

@@ -2,14 +2,13 @@ name: Auto approve and Merge Dependabot PRs
 on:
   pull_request_target:
     types: [labeled]
+permissions:
+  pull-requests: write
 
 jobs:
   auto-approve:
     name: Auto-approve dependabot PRs
     runs-on: ubuntu-24.04
-    permissions:
-      pull-requests: write
-      contents: write
     if: github.event.pull_request.user.login == 'dependabot[bot]' && contains(github.event.pull_request.labels.*.name, 'dependencies')
     steps:
       - uses: hmarr/auto-approve-action@v4