ci: Set explicit permissions to workflows

.github/workflows/check-enforce-all-checks.yaml

@@ -1,9 +1,9 @@
 name: Check - Enforce all checks pass
 on:
   pull_request:
+permissions:
+  checks: read
 
 jobs:
   wf:
     uses: nikobockerman/github-workflows/.github/workflows/check-enforce-all-checks.yaml@c40fd048af4cc60e443fb5e0741812d69716d6a6
-    permissions:
-      checks: read

.github/workflows/check-github-actions.yaml

@@ -7,6 +7,8 @@ on:
       - "package.json"
       - "yarn.lock"
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   wf:

.github/workflows/check-mypy.yaml

@@ -1,5 +1,4 @@
 name: Check - mypy
-
 on:
   pull_request:
     paths:
@@ -11,6 +10,8 @@ on:
       - "uv.lock"
   workflow_call:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   mypy:

.github/workflows/check-prettier.yaml

@@ -1,11 +1,12 @@
 name: Check - prettier
-
 on:
   pull_request:
     paths-ignore:
       - "**.py"
       - "**/py.typed"
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   wf:

.github/workflows/check-pyright.yaml

@@ -1,5 +1,4 @@
 name: Check - pyright
-
 on:
   pull_request:
     paths:
@@ -13,6 +12,8 @@ on:
       - "yarn.lock"
   workflow_call:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   pyright:

.github/workflows/check-renovate-config.yaml

@@ -5,6 +5,8 @@ on:
       - ".github/renovate.json5"
       - ".github/workflows/check-renovate-config.yaml"
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   wf:

.github/workflows/check-ruff.yaml

@@ -1,5 +1,4 @@
 name: Check - ruff
-
 on:
   pull_request:
     paths:
@@ -11,6 +10,8 @@ on:
       - "uv.lock"
   workflow_call:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   ruff:

.github/workflows/check-yarn.yaml

@@ -1,12 +1,13 @@
 name: Check - Yarn and dependencies
-
 on:
   pull_request:
     paths:
       - ".github/workflows/check-yarn.yaml"
       - "package.json"
       - "yarn.lock"
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   wf:

.github/workflows/ci.yaml

@@ -1,5 +1,4 @@
 name: CI
-
 on:
   push:
     branches:
@@ -11,6 +10,8 @@ on:
     # Run every Monday at 00:30 UTC
     - cron: "30 0 * * 1"
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   check-github-actions:

.github/workflows/run-all.yaml

@@ -1,5 +1,4 @@
 name: Run - all
-
 on:
   pull_request:
     paths:
@@ -11,6 +10,8 @@ on:
       - "uv.lock"
   workflow_call:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   run-all:

.github/workflows/test-pytest.yaml

@@ -1,5 +1,4 @@
 name: Check - pytest
-
 on:
   pull_request:
     paths:
@@ -10,6 +9,8 @@ on:
       - "uv.lock"
   workflow_call:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   pytest: