ci: set explicit workflow permissions to read (should be a no-op) (#5318)

* We're using restricted GITHUB_TOKENS by default.
* This is expected to be a no-op operation for codeql.

.github/workflows/_integration_test.yml

@@ -3,6 +3,9 @@ name: CLI integration test
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/_lint.yml

@@ -8,6 +8,9 @@ on:
         type: string
         description: "From which folder this pipeline executes"
 
+permissions:
+  contents: read
+
 env:
   # This env var allows us to get inline annotations when ruff has complaints.
   RUFF_OUTPUT_FORMAT: github

.github/workflows/_test.yml

@@ -8,6 +8,9 @@ on:
         type: string
         description: "From which folder this pipeline executes"
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/_test_langgraph.yml

@@ -3,6 +3,9 @@ name: test
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/baseline.yml

@@ -7,6 +7,9 @@ on:
     paths:
       - "libs/**"
 
+permissions:
+  contents: read
+
 jobs:
   benchmark:
     runs-on: ubuntu-latest

.github/workflows/bench.yml

@@ -5,6 +5,9 @@ on:
     paths:
       - "libs/**"
 
+permissions:
+  contents: read
+
 jobs:
   benchmark:
     runs-on: ubuntu-latest

.github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
     branches: [main]
   pull_request:
 
+permissions:
+  contents: read
+
 # If another push to the same PR or branch happens while this workflow is still running,
 # cancel the earlier run in favor of the next run.
 #

.github/workflows/link_check.yml

@@ -11,6 +11,9 @@ on:
     - cron: "0 5 * * *"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   markdown-link-check:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -8,6 +8,9 @@ on:
         type: string
         default: "libs/langgraph"
 
+permissions:
+  contents: read
+
 env:
   PYTHON_VERSION: "3.11"
 

.github/workflows/release_js.yml

@@ -3,6 +3,9 @@ name: JS Release
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   publish:
     # Disallow publishing from branches that aren't `main`.

.github/workflows/run_notebooks.yml

@@ -11,6 +11,9 @@ on:
   schedule:
     - cron: "0 13 * * *"
 
+permissions:
+  contents: read
+
 defaults:
   run:
     working-directory: docs