chore: Add top level permissions for GHA workflows (#2398)

Add top level permissions for GHA workflows

Signed-off-by: Arko Dasgupta <[email protected]>

.github/workflows/build_and_test.yaml

@@ -12,6 +12,10 @@ on:
     - "release/v*"
     paths-ignore:
     - "**/*.png"
+
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest

.github/workflows/cherrypick.yaml

@@ -5,6 +5,9 @@ on:
       - main
     types: ["closed"]
 
+permissions:
+  contents: read
+
 jobs:
   cherry_pick_release_v0_6:
     runs-on: ubuntu-22.04

.github/workflows/docs.yaml

@@ -13,6 +13,9 @@ on:
     paths:
     - 'site/**'
 
+permissions:
+  contents: read
+
 jobs:
   docs-lint:
     runs-on: ubuntu-22.04

.github/workflows/experimental_conformance.yaml

@@ -10,6 +10,9 @@ on:
   # Add workflow_dispatch to trigger this workflow manually by maintainers.
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   experimental-conformance-test:
     runs-on: ubuntu-latest

.github/workflows/latest_release.yaml

@@ -7,6 +7,9 @@ on:
     paths-ignore:
     - "**/*.png"
 
+permissions:
+  contents: read
+
 jobs:
   latest-release:
     runs-on: ubuntu-22.04

.github/workflows/release.yaml

@@ -5,6 +5,9 @@ on:
     # Sequence of patterns matched against refs/tags
     tags:
       - "v*.*.*"
+permissions:
+  contents: read
+
 jobs:
   release:
     runs-on: ubuntu-22.04

.github/workflows/stale.yml

@@ -3,6 +3,9 @@ on:
   schedule:
   - cron: '0 */4 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   prune_stale:
     permissions: