ci: set explicit contents: read permissions on workflow jobs

.github/workflows/build-ubuntu.yml

@@ -33,6 +33,8 @@ jobs:
     # Pin to 22.04 so the wheel is built with GCC 11's libstdc++. The resulting wheel
     # then runs on both Ubuntu 22.04 and 24.04 (24.04's libstdc++ is backward compatible).
     runs-on: ${{ matrix.arch == 'arm64' && 'ubuntu-22.04-arm' || 'ubuntu-22.04' }}
+    permissions:
+      contents: read
 
     strategy:
       fail-fast: ${{ github.event_name == 'pull_request' }}
@@ -557,6 +559,8 @@ jobs:
     # where these tests SKIP cleanly; this job actually exercises the Vulkan
     # / CUDA paths that build-ubuntu cannot.
     runs-on: [self-hosted, linux, gpu, "${{ matrix.arch }}"]
+    permissions:
+      contents: read
     needs: [build-ubuntu, resolve-test-arches]
 
     strategy:
@@ -686,6 +690,8 @@ jobs:
     # in ways that produce false positives. The GPU surface is covered
     # by test-viz-gpu on the self-hosted runner.
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
     needs: build-ubuntu
 
     steps:
@@ -745,6 +751,8 @@ jobs:
 
   test-cloudxr:
     runs-on: [self-hosted, linux, gpu, "${{ matrix.arch }}"]
+    permissions:
+      contents: read
     needs: [build-ubuntu, resolve-test-arches]
 
     strategy:
@@ -788,6 +796,8 @@ jobs:
 
   test-teleop-ros2:
     runs-on: [self-hosted, linux, gpu, "${{ matrix.arch }}"]
+    permissions:
+      contents: read
     needs: [build-ubuntu, resolve-test-arches]
 
     strategy:

.github/workflows/build-windows.yml

@@ -22,6 +22,8 @@ jobs:
   build-windows:
     # Pin to windows-2025 (VS 2022) until VS 2026 is validated.
     runs-on: windows-2025
+    permissions:
+      contents: read
 
     env:
       SCCACHE_GHA_ENABLED: "true"

.github/workflows/pre-commit.yaml

@@ -10,6 +10,8 @@ on:
 jobs:
   pre-commit:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - uses: actions/checkout@v6
       with: