Merge pull request #2743 from lukaszstolarczuk/fix-workflows

Fix workflows default tokens

Author: lukaszstolarczuk

.github/workflows/benchmarks-nightly.yml

@@ -5,13 +5,15 @@ on:
     - cron: '0 0 * * *'  # Runs at midnight UTC every day
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 jobs:
   nightly:
     name: '[PVC] CB Nightly level-zero'
     uses: ./.github/workflows/benchmarks-reusable.yml
+    permissions:
+      contents: write
+      pull-requests: write
     with:
       str_name: 'level_zero'
       preset: 'Full'
@@ -27,6 +29,9 @@ jobs:
     needs: nightly
     name: '[PVC] CB Nightly level-zero v2'
     uses: ./.github/workflows/benchmarks-reusable.yml
+    permissions:
+      contents: write
+      pull-requests: write
     with:
         str_name: 'level_zero_v2'
         preset: 'Full'
@@ -40,6 +45,9 @@ jobs:
   nightly3:
     name: '[BMG] CB Nightly level-zero'
     uses: ./.github/workflows/benchmarks-reusable.yml
+    permissions:
+      contents: write
+      pull-requests: write
     with:
       str_name: 'level_zero'
       preset: 'Full'
@@ -55,6 +63,9 @@ jobs:
     needs: nightly3
     name: '[BMG] CB Nightly level-zero v2'
     uses: ./.github/workflows/benchmarks-reusable.yml
+    permissions:
+      contents: write
+      pull-requests: write
     with:
         str_name: 'level_zero_v2'
         preset: 'Full'

.github/workflows/benchmarks-reusable.yml

@@ -39,12 +39,14 @@ on:
         type: string
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 jobs:
   benchmarks:
     name: Build SYCL, UR, run Compute Benchmarks
+    permissions:
+      contents: write
+      pull-requests: write
     strategy:
       matrix:
         adapter: [

.github/workflows/benchmarks.yml

@@ -61,13 +61,15 @@ on:
           - DSS-L0-BMG
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 jobs:
   manual:
     name: Compute Benchmarks
     uses: ./.github/workflows/benchmarks-reusable.yml
+    permissions:
+      contents: write
+      pull-requests: write
     with:
       str_name: ${{ inputs.str_name }}
       pr_no: ${{ inputs.pr_no }}

.github/workflows/mirror-intel-llvm-commits.yml

@@ -7,10 +7,12 @@ on:
   # schedule:
   #   - cron: "0 * * * *"
 
+permissions:
+  contents: read
+
 jobs:
   mirror-commits:
     runs-on: ubuntu-latest
-
     permissions:
       contents: write