ci: declare workflow-level contents: read on 26 read-only workflows

.github/workflows/actions-test.yml

@@ -10,6 +10,9 @@ on:
     paths:
       - '.github/actions/upload-artifact-s3/**'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build

.github/workflows/bc-linter-tests.yml

@@ -16,6 +16,9 @@ defaults:
   run:
     working-directory: tools/stronghold/
 
+permissions:
+  contents: read
+
 jobs:
   bc-linter-tests:
     name: BC-Linter Tests

.github/workflows/checkout-licensed.yml

@@ -12,6 +12,9 @@ on:
     paths:
       - '.github/actions/checkout/**'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest

.github/workflows/checkout-test.yml

@@ -17,6 +17,9 @@ on:
 # these refer to "test-data" branches on this actions/checkout repo.
 # (For example, test-data/v2/basic -> https://github.com/actions/checkout/tree/test-data/v2/basic)
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/cross-repo-ci-relay-tests.yml

@@ -16,6 +16,9 @@ defaults:
   run:
     working-directory: aws/lambda/cross_repo_ci_relay/
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-22.04

.github/workflows/lambda-runner-binaries-syncer.yml

@@ -8,6 +8,9 @@ on:
       - .github/workflows/lambda-runner-binaries-syncer.yml
       - "terraform-aws-github-runner/modules/runner-binaries-syncer/lambdas/runner-binaries-syncer/**"
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: "Run tests for runner binaries syncer lambda"

.github/workflows/lambda-runners.yml

@@ -8,6 +8,9 @@ on:
       - .github/workflows/lambda-runners.yml
       - "terraform-aws-github-runner/modules/runners/lambdas/runners/**"
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: "Run tests for runners lambda"

.github/workflows/lambda-webhook.yml

@@ -8,6 +8,9 @@ on:
       - .github/workflows/lambda-webhook.yml
       - "terraform-aws-github-runner/modules/webhook/lambdas/webhook/**"
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: "Run tests for webhook lambda"

.github/workflows/lint.yml

@@ -12,6 +12,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}-${{ github.event_name == 'workflow_dispatch' }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   lintrunner:
     name: lintrunner

.github/workflows/scale_config_validation.yml

@@ -10,6 +10,9 @@ on:
       - .github/scale-config.yml
       - .github/scripts/validate_scale_config.py
 
+permissions:
+  contents: read
+
 jobs:
   scale-config-validation:
     runs-on: ubuntu-latest

.github/workflows/test-binary-size-validation.yml

@@ -7,6 +7,9 @@ on:
       - tools/binary_size_validation/binary_size_validation.py
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   test-binary-size-validation:
     runs-on: ubuntu-latest

.github/workflows/test-export-matrix-variables.yml

@@ -6,6 +6,9 @@ on:
       - .github/workflows/test-export-matrix-variables.yml
       - .github/actions/export-matrix-variables/*
 
+permissions:
+  contents: read
+
 jobs:
   test-linux:
     uses: ./.github/workflows/linux_job_v2.yml

.github/workflows/test-setup-miniconda.yml

@@ -7,6 +7,9 @@ on:
       - .github/actions/check-disk-space/*
       - .github/actions/setup-miniconda/*
 
+permissions:
+  contents: read
+
 jobs:
   test:
     strategy:

.github/workflows/test-setup-nvidia.yml

@@ -7,6 +7,9 @@ on:
       - .github/actions/setup-nvidia/action.yml
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     strategy:

.github/workflows/test-setup-python.yml

@@ -6,6 +6,9 @@ on:
       - .github/actions/setup-python/*
       - .github/workflows/test-setup-python.yml
 
+permissions:
+  contents: read
+
 jobs:
   setup-python-job:
     runs-on: macos-m1-stable

.github/workflows/test-setup-uv.yml

@@ -7,6 +7,9 @@ on:
       - .github/actions/setup-uv/action.yml
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     strategy:

.github/workflows/test-validate-domain-library.yml

@@ -7,6 +7,9 @@ on:
       - .github/workflows/test-validate-domain-library.yml
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   test-validate-domain-library:
     uses: ./.github/workflows/validate-domain-library.yml

.github/workflows/test_linux_job.yml

@@ -9,6 +9,9 @@ on:
       - .github/scripts/run_with_env_secrets.py
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   test-secrets-no-filter-var:
     uses: ./.github/workflows/linux_job.yml

.github/workflows/test_macos_job.yml

@@ -8,6 +8,9 @@ on:
       - .github/scripts/run_with_env_secrets.py
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   test-m1:
     uses: ./.github/workflows/macos_job.yml

.github/workflows/test_windows_job.yml

@@ -7,6 +7,9 @@ on:
       - .github/workflows/test_windows_job.yml
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   test-cpu:
     uses: ./.github/workflows/windows_job.yml

.github/workflows/tests.yml

@@ -13,6 +13,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   test-tools:
     name: Test tools

.github/workflows/torchci.yml

@@ -9,6 +9,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-24.04

.github/workflows/trigger_nightly.yml

@@ -27,6 +27,10 @@ on:
           - torchcomms
           - torchforge
           - all
+
+permissions:
+  contents: read
+
 jobs:
   trigger:
     runs-on: ubuntu-latest

.github/workflows/trigger_nightly_core.yml

@@ -6,6 +6,9 @@ on:
     - cron: 30 7 * * *
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   trigger:
     runs-on: ubuntu-latest

.github/workflows/validate-pypi-wheel-binary-size.yml

@@ -17,6 +17,9 @@ on:
     # At 2:30 pm UTC (7:30 am PDT)
     - cron: "30 14 * * *"
 
+permissions:
+  contents: read
+
 jobs:
   pypi-binary-size-validation:
     runs-on: ubuntu-latest

.github/workflows/validate-repackaged-binary-sizes.yml

@@ -18,6 +18,9 @@ on:
       - .github/workflows/validate-repackaged-binary-sizes.yml
       - release/pypi/prep_binary_for_pypi.sh
 
+permissions:
+  contents: read
+
 jobs:
   generate-linux-matrix:
     uses: ./.github/workflows/generate_binary_build_matrix.yml