Add necessary permissions/tokens for "lewagon/wait-on-check-action" so it can run nightly (#30923)

.github/workflows/prebuilt.yaml

@@ -15,6 +15,8 @@ jobs:
     if: github.repository == 'commaai/openpilot'
     env:
       PUSH_IMAGE: true
+    permissions:
+      checks: read
     steps:
     - name: Wait for green check mark
       if: ${{ github.event_name != 'workflow_dispatch' }}
@@ -23,6 +25,7 @@ jobs:
         ref: master
         wait-interval: 30
         running-workflow-name: 'build prebuilt'
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
         check-regexp: ^((?!.*(build master-ci).*).)*$
     - uses: actions/checkout@v4
       with:

.github/workflows/release.yaml

@@ -14,6 +14,8 @@ jobs:
       image: ghcr.io/commaai/openpilot-base:latest
     runs-on: ubuntu-20.04
     if: github.repository == 'commaai/openpilot'
+    permissions:
+      checks: read
     steps:
     - name: Install wait-on-check-action dependencies
       run: |
@@ -26,6 +28,7 @@ jobs:
         ref: master
         wait-interval: 30
         running-workflow-name: 'build master-ci'
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
         check-regexp: ^((?!.*(build prebuilt).*).)*$
     - uses: actions/checkout@v4
       with: