ci: declare contents: read on seven workflows missing a permissions block

Merge #5687

Co-authored-by: Xuan Yang <xygoogle@google.com>
COPYBARA_INTEGRATE_REVIEW=#5687 from arpitjain099:ci/add-permissions c145c10
PiperOrigin-RevId: 917369094

Author: 2 people

.github/workflows/check-file-contents.yml

@@ -19,6 +19,9 @@ on:
     paths:
       - '**.py'
 
+permissions:
+  contents: read
+
 jobs:
   check-file-contents:
     runs-on: ubuntu-latest

.github/workflows/discussion_answering.yml

@@ -6,6 +6,9 @@ on:
   discussion_comment:
     types: [created]
 
+permissions:
+  contents: read
+
 jobs:
   agent-answer-questions:
     if: >-

.github/workflows/mypy-new-errors.yml

@@ -7,6 +7,9 @@ on:
     branches: [ main ]
 
 
+permissions:
+  contents: read
+
 jobs:
   mypy-diff:
     runs-on: ubuntu-latest

.github/workflows/mypy.yml

@@ -3,6 +3,9 @@ name: Mypy Type Check
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   mypy:
     runs-on: ubuntu-latest

.github/workflows/pre-commit.yml

@@ -28,6 +28,9 @@ on:
       - '.pre-commit-config.yaml'
       - 'pyproject.toml'
 
+permissions:
+  contents: read
+
 jobs:
   pre-commit:
     runs-on: ubuntu-latest

.github/workflows/python-unit-tests.yml

@@ -20,6 +20,9 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest

.github/workflows/upload-adk-docs-to-vertex-ai-search.yml

@@ -7,6 +7,9 @@ on:
   # Manual trigger for testing and fixing
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   upload-adk-docs-to-vertex-ai-search:
     if: github.repository == 'google/adk-python'