Add permissions to workflows (#2554)

.github/workflows/build_assets.yml

@@ -5,6 +5,8 @@ on: workflow_call
 jobs:
   buildAssets:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout Source
         uses: actions/checkout@v5

.github/workflows/build_linux.yml

@@ -11,6 +11,8 @@ jobs:
     # Needs to stay on 22.04 as long as we're using manylinux_2_28
     # as libxcb-cursor0 in 22.04 supports glibc >= 2.17
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
     env:
       PYTHON_VERSION: "3.13"
       LINUX_TAG: "manylinux_2_28"

.github/workflows/build_mac.yml

@@ -9,6 +9,8 @@ jobs:
   buildMac-AMD64:
     needs: buildAssets
     runs-on: macos-latest
+    permissions:
+      contents: read
     env:
       PYTHON_VERSION: "3.13"
       PACKAGE_ARCH: x86_64
@@ -40,6 +42,8 @@ jobs:
   buildMac-M1:
     needs: buildAssets
     runs-on: macos-latest
+    permissions:
+      contents: read
     env:
       PYTHON_VERSION: "3.13"
       PACKAGE_ARCH: aarch64

.github/workflows/build_win.yml

@@ -9,6 +9,8 @@ jobs:
   buildWin64:
     needs: buildAssets
     runs-on: windows-2022
+    permissions:
+      contents: read
     steps:
       - name: Python Setup
         uses: actions/setup-python@v6

.github/workflows/build_win_launcher.yml

@@ -5,6 +5,8 @@ on: workflow_dispatch
 jobs:
   buildLauncherWin64:
     runs-on: windows-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout Source
         uses: actions/checkout@v5

.github/workflows/i18n.yml

@@ -8,6 +8,8 @@ on:
 jobs:
   buildI18n:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Python Setup
         uses: actions/setup-python@v6

.github/workflows/syntax.yml

@@ -13,6 +13,8 @@ on:
 jobs:
   checkSyntax:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout Source
         uses: actions/checkout@v5

.github/workflows/test_linux.yml

@@ -21,6 +21,8 @@ jobs:
           - "3.14"
       fail-fast: false
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout Source
         uses: actions/checkout@v5

.github/workflows/test_mac.yml

@@ -13,6 +13,8 @@ on:
 jobs:
   testMac:
     runs-on: macos-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout Source
         uses: actions/checkout@v5

.github/workflows/test_win.yml

@@ -13,6 +13,8 @@ on:
 jobs:
   testWin:
     runs-on: windows-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout Source
         uses: actions/checkout@v5