Set explicit token permissions on all workflows (#531)

* Initial plan

* Set explicit token permissions on all workflows with least privilege

Co-authored-by: jakecoffman <886768+jakecoffman@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: jakecoffman <886768+jakecoffman@users.noreply.github.com>

Author: Copilot

.github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
   merge_group:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -4,15 +4,16 @@ on:
   release:
     types: [published]
 
+permissions:
+  attestations: write
+  contents: write
+  id-token: write
+  packages: write
+
 jobs:
   releases-matrix:
     name: Release Go Binary
     runs-on: ubuntu-latest
-    permissions:
-        attestations: write
-        contents: write
-        id-token: write
-        packages: write
     strategy:
       matrix:
         goos: [linux, windows, darwin]

.github/workflows/smoke.yml

@@ -5,6 +5,9 @@ on:
   workflow_dispatch:
   pull_request:
 
+permissions:
+  contents: read
+
 env:
   GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}