ci: declare workflow-level contents: read on 6 CI workflows

Adds workflow-level contents: read to six CI workflows that run pure checks (checkDependencies, ci, doCleanCode, pr-checks, unit-tests, version-increments). No GitHub API writes from the workflows.

Same post-CVE-2025-30066 (tj-actions/changed-files) hardening pattern. yaml.safe_load validated.

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>

Author: arpitjain099

.github/workflows/checkDependencies.yml

@@ -7,6 +7,9 @@ on:
   schedule:
     - cron:  '0 0 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   check-dependencies:
     uses: eclipse-platform/eclipse.platform.releng.aggregator/.github/workflows/checkDependencies.yml@master

.github/workflows/ci.yml

@@ -15,6 +15,9 @@ on:
       - 'docs/**'
       - '*.md'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     uses: eclipse-platform/eclipse.platform.releng.aggregator/.github/workflows/mavenBuild.yml@master

.github/workflows/doCleanCode.yml

@@ -7,6 +7,9 @@ on:
   schedule:
     - cron:  '0 2 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   clean-code:
     uses: eclipse-platform/eclipse.platform.releng.aggregator/.github/workflows/cleanCode.yml@master

.github/workflows/pr-checks.yml

@@ -9,6 +9,9 @@ on:
   pull_request:
     branches: [ master ]
 
+permissions:
+  contents: read
+
 jobs:
   check-freeze-period:
     uses: eclipse-platform/eclipse.platform.releng.aggregator/.github/workflows/verifyFreezePeriod.yml@master

.github/workflows/unit-tests.yml

@@ -6,6 +6,9 @@ on:
     types:
       - completed
 
+permissions:
+  contents: read
+
 jobs:
     check:
        uses: eclipse-platform/eclipse.platform.releng.aggregator/.github/workflows/publishTestResults.yml@master

.github/workflows/version-increments.yml

@@ -5,6 +5,9 @@ on:
     workflows: [ 'Pull-Request Checks' ]
     types: [ completed ]
 
+permissions:
+  contents: read
+
 jobs:
   publish-version-check-results:
     uses: eclipse-platform/eclipse.platform.releng.aggregator/.github/workflows/publishVersionCheckResults.yml@master