diff --git a/.github/workflows/auto-assign.yml b/.github/workflows/auto-assign.yml
index b256adc..c902943 100644
--- a/.github/workflows/auto-assign.yml
+++ b/.github/workflows/auto-assign.yml
@@ -3,6 +3,11 @@ on:
   # pull_request_target is needed instead of just pull_request
   # because repository write permission is needed to assign reviewers
   pull_request_target:
+  
+permissions:
+  contents: read          # to read changed files
+  issues: write           # to read/write issue assignees
+  pull-requests: write    # to read/write PR reviewers
 
 jobs:
   run_self:
diff --git a/README.md b/README.md
index da67bc7..f2df6de 100644
--- a/README.md
+++ b/README.md
@@ -48,6 +48,11 @@ on:
   # the github token will not have sufficient permission to update the PR.
   pull_request_target:
 
+permissions:
+  contents: read          # to read changed files
+  issues: write           # to read/write issue assignees
+  pull-requests: write    # to read/write PR reviewers
+
 jobs:
   run_self:
     runs-on: ubuntu-latest
diff --git a/src/main.ts b/src/main.ts
index 00caa59..ae97694 100644
--- a/src/main.ts
+++ b/src/main.ts
@@ -14,8 +14,8 @@ async function main() {
 
     const { base, head } = getRefs();
 
-    core.debug(`Base commit: ${base}`)
-    core.debug(`Head commit: ${head}`)
+    core.debug(`Base commit: ${base}`);
+    core.debug(`Head commit: ${head}`);
 
     const configFile = await loadYaml(client, head, ownerFilePath);
     const config = validateConfig(configFile);