ci: add permissions for github token refresh-manifests

.github/workflows/refresh-manifests.yml

@@ -26,10 +26,11 @@ jobs:
           if [[ "${#files[*]}" -ne 0 ]]; then
             nix-instantiate --parse "${files[@]}" >/dev/null
           fi
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
           name: manifests
           path: manifests/
+          overwrite: true
 
   download-manifests-and-nix-build:
     needs: refresh-and-upload-manifests
@@ -42,10 +43,11 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - run: rm -r manifests
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4
         with:
           name: manifests
           path: manifests/
+          overwrite: true
       - name: stage manifests for nix build
         run: git add -v manifests
       - uses: cachix/install-nix-action@v22
@@ -60,16 +62,21 @@ jobs:
   download-manifests-and-commit:
     needs: [refresh-and-upload-manifests, download-manifests-and-nix-build]
     runs-on: ubuntu-latest
+    permissions:
+      # Give the default GITHUB_TOKEN write permission to commit and push the
+      # added or changed files to the repository.
+      contents: write
     steps:
       - uses: actions/checkout@v3
         with:
           persist-credentials: false
           ref: master
       - run: rm -r ./manifests
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4
         with:
           name: manifests
           path: manifests/
+          overwrite: true
       - name: Check and commit changes
         run: |
           git config --local user.email "[email protected]"