restrict the sticky-pull-request-comment permissions (#101)

* restrict the sticky-pull-request-comment permissions
* explicitly explain the version compatibility

.github/workflows/test.yml

@@ -14,7 +14,8 @@ jobs:
   test-go:
     name: Run Go lint and unit tests
     runs-on: ubuntu-20.04
-    permissions: write-all
+    permissions:
+      pull-requests: write
     steps:
       - name: Checkout
         uses: actions/checkout@v3
@@ -62,9 +63,8 @@ jobs:
           thresholds: "60 80"
       - name: Add Coverage PR Comment
         uses: marocchino/sticky-pull-request-comment@v2
-        if: github.event_name == 'pull_request'
+        if: ${{ github.event_name == 'pull_request_target' }}
         with:
-          recreate: true
           path: code-coverage-results.md
       - name: Dump docker logs on failure
         if: failure()

README.md

@@ -48,7 +48,9 @@ For more information, see package [`github.com/shurcooL/githubv4`](https://githu
 
 ## Installation
 
-`go-graphql-client` requires Go version 1.20 or later. For older Go versions, downgrade the library version below v0.7.1.
+`go-graphql-client` requires Go version 1.20 or later. For older Go versions: 
+- **>= 1.16 < 1.20**: downgrade the library to version v0.9.x
+- **< 1.16**: downgrade the library version below v0.7.1.
 
 ```bash
 go get -u github.com/hasura/go-graphql-client