chore: hardening workflow scripts (#733)

.github/workflows/pr-title.yaml

@@ -7,6 +7,10 @@ on:
       - edited
       - synchronize
 
+permissions:
+  pull-requests: read
+  issues: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
@@ -30,6 +34,9 @@ jobs:
             ${{ runner.os }}-
 
       - name: Check if PR title follows conventional commit guidelines
+        env:
+          # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
+          PR_TITLE: ${{ github.event.pull_request.title }}
         run: |
           npm i -g @commitlint/cli@17.0.2 @commitlint/config-conventional@17.0.2
-          echo "${{ github.event.pull_request.title }}" | commitlint
+          echo "$PR_TITLE" | commitlint