ci: add explicit permissions to GitHub Actions workflows

Most workflows lacked a `permissions` block, causing GitHub security
warnings. Added `permissions: contents: read` at the top level for all
affected workflows.

Special cases:
- `benchmark-comment-trigger`: also needs `pull-requests: read` to call the pulls REST API
- `nightly_run`: `run` job needs `actions: write` to dispatch `file_verification.yml`
- `rust`: `clippy` job-level permissions updated to include `contents: read` alongside `checks: write`
- `cargo-publish`: `build` job updated to include `contents: read` alongside `id-token: write`

Author: wjones127

.github/workflows/approve-rc.yml

@@ -13,6 +13,9 @@ on:
         default: false
         type: boolean
 
+permissions:
+  contents: read
+
 jobs:
   approve-rc:
     runs-on: ubuntu-latest

.github/workflows/benchmark-comment-trigger.yml

@@ -13,6 +13,10 @@ on:
   issue_comment:
     types: [created]
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   forward-to-bench:
     # Only process comments on PRs that mention @bench-bot and contain 'benchmark'

.github/workflows/benchmarks.yml

@@ -3,6 +3,9 @@ name: Run benchmarks
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   dataset:
     timeout-minutes: 30

.github/workflows/buf-publish.yml

@@ -11,6 +11,9 @@ on:
         default: ''
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   push-module:
     runs-on: ubuntu-latest

.github/workflows/cargo-publish.yml

@@ -24,11 +24,15 @@ env:
   CARGO_INCREMENTAL: "0"
   RUSTFLAGS: "-C debuginfo=0"
 
+permissions:
+  contents: read
+
 jobs:
   build:
     # Needs additional disk space for the full build.
     runs-on: ubuntu-24.04-8x
     permissions:
+      contents: read
       id-token: write
     timeout-minutes: 60
     env:

.github/workflows/ci-benchmarks.yml

@@ -6,6 +6,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   bench_regress:
     timeout-minutes: 120

.github/workflows/create-rc.yml

@@ -13,6 +13,9 @@ on:
         default: false
         type: boolean
 
+permissions:
+  contents: read
+
 jobs:
   create-rc:
     runs-on: ubuntu-latest

.github/workflows/create-release-branch.yml

@@ -14,6 +14,9 @@ on:
         default: false
         type: boolean
 
+permissions:
+  contents: read
+
 jobs:
   create-release-branch:
     runs-on: ubuntu-latest

.github/workflows/docs-check.yml

@@ -13,6 +13,9 @@ on:
       - docs/**
       - .github/workflows/docs-check.yml
 
+permissions:
+  contents: read
+
 env:
   RUSTFLAGS: "-C debuginfo=0"
   # according to: https://matklad.github.io/2021/09/04/fast-rust-builds.html

.github/workflows/java-publish.yml

@@ -24,6 +24,9 @@ on:
         required: false
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   linux-arm64:
     name: Build on Linux Arm64