ci: declare explicit read-only permissions on reusable workflows (#3243)

Author: arpitjain099

.github/workflows/_build_python_wheels.yml

@@ -43,6 +43,9 @@ on:
         description: "Name of the uploaded artifact containing wheels"
         value: ${{ jobs.collect.outputs.artifact_name }}
 
+permissions:
+  contents: read
+
 jobs:
   linux:
     runs-on: ${{ matrix.runner }}

.github/workflows/_build_rust_artifacts.yml

@@ -53,6 +53,9 @@ on:
         description: "Name of the uploaded artifact containing all artifacts"
         value: ${{ jobs.collect.outputs.artifact_name }}
 
+permissions:
+  contents: read
+
 env:
   IGGY_CI_BUILD: true
 

.github/workflows/_detect.yml

@@ -51,6 +51,9 @@ on:
         description: "Matrix for other components"
         value: ${{ jobs.detect.outputs.other_matrix }}
 
+permissions:
+  contents: read
+
 jobs:
   detect:
     runs-on: ubuntu-latest