[eng-1653] Scope workflow permissions to individual jobs

.github/workflows/build_release.yml

@@ -5,13 +5,14 @@ on:
     tags:
       - "v*"
 
-permissions:
-  contents: write
+permissions: {}
 
 jobs:
   release:
     name: Build and publish release artifacts
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
 
     steps:
       - name: Check out tagged commit

.github/workflows/lint.yml

@@ -6,8 +6,7 @@ on:
     branches:
       - main
 
-permissions:
-  contents: read
+permissions: {}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
@@ -17,6 +16,8 @@ jobs:
   format:
     name: Format
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Check out code
@@ -40,6 +41,8 @@ jobs:
   lint:
     name: Lint
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Check out code
@@ -57,6 +60,8 @@ jobs:
   shell:
     name: Shell
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Check out code

.github/workflows/pr-cost.yml

@@ -10,13 +10,14 @@ on:
         required: true
         type: number
 
-permissions:
-  pull-requests: write
-  issues: write
+permissions: {}
 
 jobs:
   cost:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
+      issues: write
     steps:
       - uses: actions/github-script@v7
         env:

.github/workflows/tests.yml

@@ -6,8 +6,7 @@ on:
     branches:
       - main
 
-permissions:
-  contents: read
+permissions: {}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
@@ -17,6 +16,8 @@ jobs:
   unit-tests:
     name: Unit tests
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Check out code