Fix #891: declare default GitHub Actions workflow permissions

.github/workflows/ci-build-checks.yaml

@@ -86,6 +86,9 @@ env:
     ^\.github/problem-matchers/.*
     ^benchmarks/.*
 
+# Declare default workflow permissions as read only.
+permissions: read-all
+
 concurrency:
   # Cancel any previously-started but still active runs on the same branch.
   cancel-in-progress: true

.github/workflows/ci-file-checks.yaml

@@ -65,6 +65,9 @@ env:
   # GitHub, and you have to use Ubuntu 24 to get it.
   clang_format_ver: '18'
 
+# Declare default workflow permissions as read only.
+permissions: read-all
+
 concurrency:
   # Cancel any previously-started but still active runs on the same branch.
   cancel-in-progress: true

.github/workflows/ci-nightly-build-test.yaml

@@ -55,6 +55,9 @@ concurrency:
   cancel-in-progress: true
   group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}}
 
+# Declare default workflow permissions as read only.
+permissions: read-all
+
 jobs:
   Decision:
     runs-on: ubuntu-24.04

.github/workflows/ci-nightly-cirq-test.yaml

@@ -6,7 +6,7 @@
 # For testing, this workflow can be invoked manually from the GitHub page at
 # https://github.com/tensorflow/quantum/actions/workflows/ci-nightly-cirq-test.yaml
 # Clicking the "Run workflow" button there will present a form interface with
-# options for overridding some of the parameters for the run.
+# options for overriding some of the parameters for the run.
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 # yamllint disable rule:line-length
 
@@ -70,6 +70,9 @@ concurrency:
   cancel-in-progress: true
   group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}}
 
+# Declare default workflow permissions as read only.
+permissions: read-all
+
 jobs:
   test-compatibility:
     name: Run TFQ tests