chore: add permissions: contents: read to all workflow jobs

Author: texastony

.github/workflows/ci_codegen.yml

@@ -10,6 +10,8 @@ on:
 
 jobs:
   code-generation:
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:

.github/workflows/ci_duvet.yml

@@ -11,6 +11,8 @@ on:
 
 jobs:
   duvet:
+    permissions:
+      contents: read
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v6

.github/workflows/ci_static_analysis.yml

@@ -9,6 +9,8 @@ on:
 
 jobs:
   not-grep:
+    permissions:
+      contents: read
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v6

.github/workflows/ci_todos.yml

@@ -9,6 +9,8 @@ on:
 
 jobs:
   findTodos:
+    permissions:
+      contents: read
     runs-on: macos-14
     steps:
       - uses: actions/checkout@v6

.github/workflows/dafny-interop.yml

@@ -22,10 +22,14 @@ on:
 
 jobs:
   getMplHeadVersion:
+    permissions:
+      contents: read
     uses: ./.github/workflows/mpl_head_version.yml
     with:
       mpl-head: ${{inputs.mpl-commit}}
   dafny-interop-java:
+    permissions:
+      contents: read
     needs: getMplHeadVersion
     uses: ./.github/workflows/dafny_interop_java.yml
     with:
@@ -34,6 +38,8 @@ jobs:
       mpl-version: ${{needs.getMplHeadVersion.outputs.version}}
       dbesdk-dafny: ${{inputs.dbesdk-dafny}}
   dafny-interop-java-test-vectors:
+    permissions:
+      contents: read
     needs: getMplHeadVersion
     uses: ./.github/workflows/dafny_interop_test_vector_java.yml
     with:
@@ -42,6 +48,8 @@ jobs:
       mpl-version: ${{needs.getMplHeadVersion.outputs.version}}
       dbesdk-dafny: ${{inputs.dbesdk-dafny}}
   dafny-interop-java-examples:
+    permissions:
+      contents: read
     needs: getMplHeadVersion
     uses: ./.github/workflows/dafny_interop_examples_java.yml
     with:
@@ -50,18 +58,24 @@ jobs:
       mpl-version: ${{needs.getMplHeadVersion.outputs.version}}
       dbesdk-dafny: ${{inputs.dbesdk-dafny}}
   dafny-interop-net:
+    permissions:
+      contents: read
     uses: ./.github/workflows/dafny_interop_test_net.yml
     with:
       mpl-dafny: ${{inputs.mpl-dafny}}
       mpl-commit: ${{inputs.mpl-commit}}
       dbesdk-dafny: ${{inputs.dbesdk-dafny}}
   dafny-interop-net-test-vectors:
+    permissions:
+      contents: read
     uses: ./.github/workflows/dafny_interop_test_vector_net.yml
     with:
       mpl-dafny: ${{inputs.mpl-dafny}}
       mpl-commit: ${{inputs.mpl-commit}}
       dbesdk-dafny: ${{inputs.dbesdk-dafny}}
   dafny-interop-net-examples:
+    permissions:
+      contents: read
     uses: ./.github/workflows/dafny_interop_examples_net.yml
     with:
       mpl-dafny: ${{inputs.mpl-dafny}}

.github/workflows/dafny_verify_version.yml

@@ -12,6 +12,8 @@ on:
 
 jobs:
   getDafnyVerifyVersion:
+    permissions:
+      contents: read
     runs-on: ubuntu-22.04
     outputs:
       version: ${{ steps.read_property.outputs.dafnyVerifyVersion }}

.github/workflows/dafny_version.yml

@@ -12,6 +12,8 @@ on:
 
 jobs:
   getDafnyVersion:
+    permissions:
+      contents: read
     runs-on: ubuntu-22.04
     outputs:
       version: ${{ steps.read_property.outputs.dafnyVersion }}

.github/workflows/daily_ci.yml

@@ -13,71 +13,99 @@ on:
 
 jobs:
   getVersion:
+    permissions:
+      contents: read
     # Don't run the cron builds on forks
     if: github.event_name != 'schedule' || github.repository_owner == 'aws'
     uses: ./.github/workflows/dafny_version.yml
   getVerifyVersion:
+    permissions:
+      contents: read
     if: github.event_name != 'schedule' || github.repository_owner == 'aws'
     uses: ./.github/workflows/dafny_verify_version.yml
   daily-ci-format:
+    permissions:
+      contents: read
     needs: getVersion
     if: github.event_name != 'schedule' || github.repository_owner == 'aws'
     uses: ./.github/workflows/library_format.yml
     with:
       dafny: ${{needs.getVersion.outputs.version}}
   daily-ci-codegen:
+    permissions:
+      contents: read
     needs: getVersion
     if: github.event_name != 'schedule' || github.repository_owner == 'aws'
     uses: ./.github/workflows/ci_codegen.yml
     with:
       dafny: ${{needs.getVersion.outputs.version}}
   daily-ci-verification:
+    permissions:
+      contents: read
     needs: getVerifyVersion
     if: github.event_name != 'schedule' || github.repository_owner == 'aws'
     uses: ./.github/workflows/library_dafny_verification.yml
     with:
       dafny: ${{needs.getVerifyVersion.outputs.version}}
   daily-ci-test-vector-verification:
+    permissions:
+      contents: read
     needs: getVerifyVersion
     uses: ./.github/workflows/test_vector_verification.yml
     with:
       dafny: ${{needs.getVerifyVersion.outputs.version}}
   daily-ci-java:
+    permissions:
+      contents: read
     needs: getVersion
     uses: ./.github/workflows/ci_test_java.yml
     with:
       dafny: ${{needs.getVersion.outputs.version}}
   daily-ci-java-test-vectors:
+    permissions:
+      contents: read
     needs: getVersion
     uses: ./.github/workflows/ci_test_vector_java.yml
     with:
       dafny: ${{needs.getVersion.outputs.version}}
   daily-ci-java-examples:
+    permissions:
+      contents: read
     needs: getVersion
     uses: ./.github/workflows/ci_examples_java.yml
     with:
       dafny: ${{needs.getVersion.outputs.version}}
   daily-ci-net:
+    permissions:
+      contents: read
     needs: getVersion
     uses: ./.github/workflows/ci_test_net.yml
     with:
       dafny: ${{needs.getVersion.outputs.version}}
   daily-ci-rust:
+    permissions:
+      contents: read
     needs: getVersion
     uses: ./.github/workflows/library_rust_tests.yml
     with:
       dafny: ${{needs.getVersion.outputs.version}}
   daily-ci-net-test-vectors:
+    permissions:
+      contents: read
     needs: getVersion
     uses: ./.github/workflows/ci_test_vector_net.yml
     with:
       dafny: ${{needs.getVersion.outputs.version}}
   daily-ci-net-examples:
+    permissions:
+      contents: read
     needs: getVersion
     uses: ./.github/workflows/ci_examples_net.yml
     with:
       dafny: ${{needs.getVersion.outputs.version}}
   notify:
+    permissions:
+      contents: read
     needs:
       [
         getVersion,

.github/workflows/go-release.yml

@@ -14,6 +14,8 @@ on:
 
 jobs:
   get-dafny-version:
+    permissions:
+      contents: read
     uses: ./.github/workflows/dafny_version.yml
 
   go-release:

.github/workflows/issue-notification.yml

@@ -7,6 +7,8 @@ on:
 
 jobs:
   notify-issue:
+    permissions:
+      contents: read
     if: github.event_name == 'issues'
     uses: aws/aws-cryptographic-material-providers-library/.github/workflows/slack-notification.yml@main
     with:
@@ -15,6 +17,8 @@ jobs:
       SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL_GHI }}
 
   notify-comment:
+    permissions:
+      contents: read
     if: github.event_name == 'issue_comment' && !github.event.issue.pull_request
     uses: aws/aws-cryptographic-material-providers-library/.github/workflows/slack-notification.yml@main
     with: