Add permissions to publish action (#13)

* Add permissions to publish action
Closes https://github.com/b0bcarlson/bobcodes.net/security/code-scanning/1

* Pin terraform to 1.11.1; Pin digitalocean provider
Ref hashicorp/terraform#36704

Author: b0bcarlson

.github/workflows/publish.yml

@@ -4,6 +4,9 @@ on:
     branches:
       - main
   workflow_dispatch:
+permissions:
+  pull-requests: write
+  contents: read
 jobs:
   publish:
     runs-on: ubuntu-latest
@@ -18,6 +21,8 @@ jobs:
         uses: actions/[email protected]
       - name: Setup Terraform
         uses: hashicorp/[email protected]
+        with:
+          terraform_version: "1.11.1"
       - name: Init Terraform
         working-directory: terraform
         run: terraform init -input=false

.github/workflows/pull-request.yml

@@ -20,6 +20,8 @@ jobs:
         uses: actions/[email protected]
       - name: Setup Terraform
         uses: hashicorp/[email protected]
+        with:
+          terraform_version: "1.11.1"
       - name: Init Terraform
         working-directory: terraform
         run: terraform init -input=false

terraform/main.tf

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     digitalocean = {
       source  = "digitalocean/digitalocean"
-      version = "~> 2.0"
+      version = "2.49.1"
     }
   }
 }