ci: declare workflow-level contents: read on 12 workflows

Pins the default GITHUB_TOKEN to contents: read on the workflows in
.github/workflows/ that don't call a GitHub API beyond the initial
checkout. The other workflows in this directory are left implicit
because they need write scopes that a maintainer is better placed
to declare.

Motivation: CVE-2025-30066 (March 2025 tj-actions/changed-files
compromise) exfiltrated GITHUB_TOKEN from workflow logs. Per-workflow
caps bound runtime authority irrespective of repo or org default,
give drift protection if the default ever widens, and are credited
per-file by the OpenSSF Scorecard Token-Permissions check.

YAML validated locally with yaml.safe_load.

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>

Author: arpitjain099

.github/workflows/build-presets.yml

@@ -12,6 +12,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}-${{ github.event_name == 'workflow_dispatch' }}-${{ github.event_name == 'schedule' }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   apple:
     uses: pytorch/test-infra/.github/workflows/macos_job.yml@main

.github/workflows/cherry-pick.yml

@@ -4,6 +4,9 @@ on:
   repository_dispatch:
     types: [try-cherry-pick]
 
+permissions:
+  contents: read
+
 jobs:
   cherry-pick:
     name: cherry-pick-pr-${{ github.event.client_payload.pr_num }}

.github/workflows/ghstack_land.yml

@@ -5,6 +5,9 @@ on:
     branches:
       - 'gh/*/[0-9]+/base'
 
+permissions:
+  contents: read
+
 jobs:
   ghstack_merge_to_main:
     name: Try to create a PR with ghstack /orig branch

.github/workflows/metal.yml

@@ -20,6 +20,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}-${{ github.event_name == 'workflow_dispatch' }}-${{ github.event_name == 'schedule' }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   test-metal-builds:
     name: test-executorch-metal-build

.github/workflows/test-backend-arm.yml

@@ -16,6 +16,9 @@ concurrency:
   group: ${{ github.workflow }}--${{ github.event.pull_request.number || github.sha }}-${{ github.event_name == 'workflow_dispatch' }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   test-arm:
     uses: ./.github/workflows/_test_backend.yml

.github/workflows/test-backend-coreml.yml

@@ -16,6 +16,9 @@ concurrency:
   group: ${{ github.workflow }}--${{ github.event.pull_request.number || github.sha }}-${{ github.event_name == 'workflow_dispatch' }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   test-coreml:
     uses: ./.github/workflows/_test_backend.yml

.github/workflows/test-backend-openvino.yml

@@ -18,6 +18,9 @@ concurrency:
   group: ${{ github.workflow }}--${{ github.event.pull_request.number || github.sha }}-${{ github.event_name == 'workflow_dispatch' }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   test-openvino:
     uses: ./.github/workflows/_test_backend.yml

.github/workflows/test-backend-qnn.yml

@@ -16,6 +16,9 @@ concurrency:
   group: ${{ github.workflow }}--${{ github.event.pull_request.number || github.sha }}-${{ github.event_name == 'workflow_dispatch' }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   test-qnn:
     uses: ./.github/workflows/_test_backend.yml

.github/workflows/test-backend-vulkan.yml

@@ -16,6 +16,9 @@ concurrency:
   group: ${{ github.workflow }}--${{ github.event.pull_request.number || github.sha }}-${{ github.event_name == 'workflow_dispatch' }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   test-vulkan:
     uses: ./.github/workflows/_test_backend.yml

.github/workflows/test-backend-xnnpack.yml

@@ -16,6 +16,9 @@ concurrency:
   group: ${{ github.workflow }}--${{ github.event.pull_request.number || github.sha }}-${{ github.event_name == 'workflow_dispatch' }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   test-xnnpack:
     uses: ./.github/workflows/_test_backend.yml