ci: restrict permissions

Author: kkebo

.github/workflows/ci.yml

@@ -4,9 +4,12 @@ on:
     branches: ["main"]
   pull_request:
     branches: ["main"]
+permissions: {}
 jobs:
   build-linux:
     runs-on: ubuntu-24.04-arm
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
       - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v4.3.0
@@ -22,26 +25,34 @@ jobs:
       - run: swift build -c release --triple aarch64-none-none-elf --toolset toolset.json
   build-macos:
     runs-on: macos-26
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
       - run: ./scripts/ci-install-swift.sh
       - run: swift --version
       - run: swift build -c release --triple aarch64-none-none-elf --toolset toolset.json
   lint:
     runs-on: ubuntu-24.04-arm
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
       - run: ./scripts/ci-install-swift.sh
       - run: swift --version
       - run: swift format lint -rsp .
   yamllint:
     runs-on: ubuntu-24.04-arm
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
       - run: yamllint --version
       - run: yamllint --strict --config-file .yamllint.yml .
   shellcheck:
     runs-on: ubuntu-24.04-arm
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
       - run: shellcheck -V