Set workflow permissions to read

.github/workflows/cffconvert.yml

@@ -5,6 +5,9 @@ on:
     paths:
       - CITATION.cff
 
+permissions:
+  contents: read
+
 jobs:
   validate:
     name: "validate"

.github/workflows/generate-xcframework-maccatalyst.yml

@@ -9,6 +9,9 @@ on:
 env:
   python_version: 3.11
 
+permissions:
+  contents: read
+
 jobs:
   build_macabi_xcf:
     name: build_${{ matrix.variant }}_xcf

.github/workflows/gradle-wrapper-validation.yml

@@ -5,6 +5,9 @@
 name: "Validate Gradle Wrapper"
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   validation:
     name: "Validation"

.github/workflows/mac.yml

@@ -18,6 +18,9 @@ concurrency:
 env:
   python_version: 3.11
 
+permissions:
+  contents: read
+
 jobs:
   ARM64-Xcode16:
     runs-on: macos-15

.github/workflows/publish-gh-pages.yml

@@ -6,6 +6,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   placeholder:
     runs-on: ["self-hosted", "1ES.Pool=onnxruntime-github-Ubuntu2204-AMD-CPU"]

.github/workflows/windows.yml

@@ -14,6 +14,9 @@ env:
   AZCOPY_AUTO_LOGIN_TYPE: MSI
   AZCOPY_MSI_CLIENT_ID: 63b63039-6328-442f-954b-5a64d124e5b4
 
+permissions:
+  contents: read
+
 jobs:
   Windows-CUDA-12:
     if: github.event_name != 'pull_request'