add top-level token permissions for workflows (#7795)

Signed-off-by: Timothy Lee <tklee@google.com>

.github/workflows/codeql-analysis.yml

@@ -16,14 +16,15 @@ on:
     branches: [ main, release-* ]
 
 permissions:
-  actions: read
   contents: read
-  security-events: write
 
 jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      security-events: write
 
     strategy:
       fail-fast: false

.github/workflows/link-checker.yaml

@@ -6,6 +6,9 @@ on:
   schedule:
   - cron: "0 0 1 * *" # At 00:00 on day-of-month 1
 
+permissions:
+  contents: read
+
 jobs:
   linkChecker:
     runs-on: ubuntu-latest

.github/workflows/post-tag.yaml

@@ -5,6 +5,9 @@ on:
     tags:
       - "*"
 
+permissions:
+  contents: read
+
 jobs:
   generate:
     name: Generate Code
@@ -94,6 +97,8 @@ jobs:
     name: Push Latest Release
     needs: [release-build, release-build-darwin]
     runs-on: ubuntu-24.04
+    permissions:
+      contents: write
     steps:
       - name: Check out code
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

.github/workflows/pull-request.yaml

@@ -8,6 +8,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   # Check what types of changes this PR contains
   check-changes: