Add default permissions to workflow files

.github/workflows/CI.yml

@@ -1,5 +1,8 @@
 name: CI
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:

.github/workflows/PR.yml

@@ -15,8 +15,4 @@ concurrency:
 jobs:
   run_ci:
     name: Run CI
-    uses: ./.github/workflows/CI.yml
-    permissions:
-      contents: read
-      checks: write
-      pull-requests: write
+    uses: ./.github/workflows/CI.yml

.github/workflows/check_docs.yml

@@ -1,5 +1,8 @@
 name: Check docs
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
   workflow_dispatch:

.github/workflows/check_examples.yml

@@ -1,5 +1,8 @@
 name: Check examples
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
   workflow_dispatch:

.github/workflows/check_ni_datastore.yml

@@ -1,5 +1,8 @@
 name: Check analyzers
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
   workflow_dispatch:

.github/workflows/check_utilities.yml

@@ -1,5 +1,8 @@
 name: Check utilities
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
   workflow_dispatch:

.github/workflows/publish.yml

@@ -1,5 +1,8 @@
 name: Publish ni.datastore
 
+permissions:
+  contents: read
+
 on:
   release:
     types: [published]

.github/workflows/run_unit_tests.yml

@@ -1,5 +1,8 @@
 name: Run unit tests
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
     inputs:

.github/workflows/sync_github_issues_to_azdo.yml

@@ -1,5 +1,10 @@
 name: Sync issue to Azure DevOps work item
 
+# This workflow uses secrets.GH_REPO_TOKEN, which is not affected by the
+# permissions block. Since this workflow doesn't use the built-in
+# GITHUB_TOKEN, we can leave the permissions blank.
+permissions: {}
+
 on:
   issues:
     # Omit "labeled" and "unlabeled" to work around https://github.com/danhellem/github-actions-issue-to-work-item/issues/70