ci: give every Unity Cloud Build job a least-privilege permissions block

Audited every token-consuming operation per job: prebuild needs
contents:read (checkout + version composite's git fetch), statuses:write
(the four createCommitStatus calls) and pull-requests:read (changed-files
REST fallback); build needs contents:read, actions:read (runs/{id}/jobs)
and pull-requests:write (status-comment CRUD via build.py); build-gate
touches no token at all. The two workflow_call callers' build jobs get
the union block so the calls keep working if the repo default token
ever tightens (a caller caps its callee).

Fork PRs already run with a read-only token regardless of these blocks;
status/comment writes there fail today and are unchanged by this.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: eordano

.github/workflows/build-profile-nightly.yml

@@ -71,6 +71,13 @@ jobs:
     name: Build Unity Cloud
     needs: [check-commits, get-info]
     if: needs.check-commits.outputs.should_build == 'true'
+    # Union of the called workflow's job-level grants — a caller caps its
+    # callee, so this keeps the call working if the repo default tightens.
+    permissions:
+      contents: read
+      statuses: write
+      actions: read
+      pull-requests: write
     uses: ./.github/workflows/build-unitycloud.yml
     with:
       profile: profile

.github/workflows/build-release-main.yml

@@ -38,6 +38,13 @@ jobs:
   build:
     name: Build Unity Cloud
     needs: get-info
+    # Union of the called workflow's job-level grants — a caller caps its
+    # callee, so this keeps the call working if the repo default tightens.
+    permissions:
+      contents: read
+      statuses: write
+      actions: read
+      pull-requests: write
     strategy:
       matrix:
         install_source: ['launcher', 'epic']

.github/workflows/build-unitycloud.yml

@@ -209,6 +209,14 @@ jobs:
   prebuild:
     name: Prebuild
     runs-on: ubuntu-latest
+    # contents: read — checkout + the version composite's `git fetch origin main:main --tags`
+    #   over the checkout's persisted credentials.
+    # statuses: write — "Skip build and test checks" posts 4 commit statuses via github-script.
+    # pull-requests: read — step-security/changed-files' REST fallback (GET /pulls/{n}/files).
+    permissions:
+      contents: read
+      statuses: write
+      pull-requests: read
     timeout-minutes: 20
     # Skip when PR has 'perf_test' label (only performance tests should run)
     if: |
@@ -550,6 +558,14 @@ jobs:
     runs-on: ubuntu-latest
     needs: prebuild
     if: needs.prebuild.outputs.should_build == 'true'
+    # contents: read — checkout + the size-budget step's GET /releases/latest.
+    # actions: read — build.py resolves its own job URL via GET /actions/runs/{run_id}/jobs.
+    # pull-requests: write — live CI status comment upsert (issue-comment POST/PATCH/DELETE
+    #   on the PR via .github/actions/ci-status-comment/upsert-ci-status.sh).
+    permissions:
+      contents: read
+      actions: read
+      pull-requests: write
     # Safety ceiling around the 450m retry budget + surrounding steps.
     timeout-minutes: 510
     strategy:
@@ -1018,6 +1034,8 @@ jobs:
   build-gate:
     name: Build Gate (Windows + macOS)
     runs-on: ubuntu-latest
+    # Pure bash over needs.* context — no checkout, no token use.
+    permissions: {}
     needs: [prebuild, build]
     if: always() && github.event_name == 'pull_request'
     steps: