ci: add explicit token permissions

.github/workflows/audit-javascript.yml

@@ -29,6 +29,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permisisons:
+  contents: read
+
 jobs:
   audit-js:
     runs-on: ubuntu-latest

.github/workflows/audit-rust.yml

@@ -29,6 +29,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permisisons:
+  contents: read
+
 jobs:
   audit-rust:
     runs-on: ubuntu-latest

.github/workflows/check-change-files.yml

@@ -13,6 +13,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permisisons:
+  contents: read
+
 jobs:
   check:
     runs-on: ubuntu-latest

.github/workflows/check-generated-files.yml

@@ -15,6 +15,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permisisons:
+  contents: read
+
 jobs:
   changes:
     runs-on: ubuntu-latest

.github/workflows/check-license-header.yml

@@ -11,6 +11,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permisisons:
+  contents: read
+
 jobs:
   check:
     runs-on: ubuntu-latest

.github/workflows/covector-status.yml

@@ -5,6 +5,9 @@
 name: covector status
 on: [pull_request]
 
+permisisons:
+  contents: read
+
 jobs:
   covector:
     runs-on: ubuntu-latest

.github/workflows/fmt.yml

@@ -7,6 +7,9 @@ name: check formatting
 on:
   pull_request:
 
+permisisons:
+  contents: read
+
 jobs:
   rustfmt:
     runs-on: ubuntu-latest

.github/workflows/integration-tests.yml

@@ -21,6 +21,9 @@ on:
       - '.github/workflows/integration-tests.yml'
       - 'plugins/updater/src/**'
 
+permisisons:
+  contents: read
+
 jobs:
   run-integration-tests:
     runs-on: ${{ matrix.platform }}

.github/workflows/lint-javascript.yml

@@ -32,6 +32,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permisisons:
+  contents: read
+
 jobs:
   eslint:
     runs-on: ubuntu-latest

.github/workflows/lint-rust.yml

@@ -28,6 +28,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permisisons:
+  contents: read
+
 jobs:
   changes:
     runs-on: ubuntu-latest

.github/workflows/sync.yml

@@ -15,6 +15,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permisisons:
+  contents: read
+
 jobs:
   sync-to-mirrors:
     runs-on: ubuntu-latest

.github/workflows/test-android.yml

@@ -15,6 +15,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permisisons:
+  contents: read
+
 jobs:
   test:
     runs-on: ${{ matrix.platform }}

.github/workflows/test-rust.yml

@@ -30,6 +30,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permisisons:
+  contents: read
+
 jobs:
   changes:
     runs-on: ubuntu-latest