ci: enforce least-privilege GitHub Actions permissions

Author: HAYDEN-OAI

.github/workflows/ci.yml

@@ -1,6 +1,5 @@
 name: CI
-permissions:
-  contents: read
+permissions: {}
 on:
   push:
     branches:
@@ -14,6 +13,8 @@ jobs:
   lint:
     timeout-minutes: 10
     name: lint
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -62,8 +63,7 @@ jobs:
     needs:
       - build-artifacts
     if: always()
-    permissions:
-      contents: read
+    permissions: {}
     runs-on: ubuntu-latest
     steps:
       - name: Require successful build
@@ -78,6 +78,8 @@ jobs:
   test:
     timeout-minutes: 10
     name: test
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

.github/workflows/create-releases.yml

@@ -1,4 +1,5 @@
 name: Create releases
+permissions: {}
 on:
   schedule:
     - cron: '0 5 * * *' # every day at 5am UTC

.github/workflows/dispatch-publish-release.yml

@@ -1,7 +1,6 @@
 ---
 name: Dispatch Publish Release
-permissions:
-  actions: write
+permissions: {}
 
 on:
   push:
@@ -11,6 +10,8 @@ on:
 jobs:
   dispatch:
     if: github.repository == 'openai/openai-cli'
+    permissions:
+      actions: write
     runs-on: ubuntu-latest
     steps:
     - name: Dispatch Publish Release on main

.github/workflows/publish-release.yml

@@ -1,6 +1,8 @@
 ---
 name: Publish Release
 
+permissions: {}
+
 concurrency:
   group: publish