chore(ci): add permissions to CI workflows

.github/workflows/bump-aztec-packages-commit.yml

@@ -11,6 +11,9 @@ jobs:
   bump-commit:
     name: Update external repo pinned commits
     runs-on: ubuntu-22.04
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - name: Checkout repo
         uses: actions/checkout@v5
@@ -20,7 +23,7 @@ jobs:
       - name: Check for existing PR
         id: pr-check
         run: |
-          set -xue # print commands         
+          set -xue # print commands
           PR_URL=$(gh pr list --repo noir-lang/noir --head bump-aztec-packages --json url --jq ".[0].url")
           echo "pr_url=$PR_URL" >> $GITHUB_OUTPUT
         env:
@@ -29,8 +32,8 @@ jobs:
       - name: Configure git
         run: |
           git config user.name noirwhal
-          git config user.email tomfrench@aztecprotocol.com    
-        
+          git config user.email tomfrench@aztecprotocol.com
+
       - name: Update commit
         run: |
           git checkout bump-aztec-packages || git checkout -b bump-aztec-packages

.github/workflows/cache-cleanup.yml

@@ -13,15 +13,17 @@ on:
 jobs:
   cleanup:
     runs-on: ubuntu-22.04
+    permissions:
+      contents: write
     steps:
       - name: Cleanup
         run: |
           gh extension install actions/gh-actions-cache
-          
+
           echo "Fetching list of cache key"
           cacheKeysForPR=$(gh actions-cache list -R $REPO -B $BRANCH -L 100 | cut -f 1 )
 
-          ## Setting this to not fail the workflow while deleting cache keys. 
+          ## Setting this to not fail the workflow while deleting cache keys.
           set +e
           echo "Deleting caches..."
           for cacheKey in $cacheKeysForPR

.github/workflows/deny.yml

@@ -19,6 +19,8 @@ jobs:
   deny:
     name: deny
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v5
       - uses: EmbarkStudios/cargo-deny-action@30f817c6f72275c6d54dc744fbca09ebc958599f

.github/workflows/docs-dead-links.yml

@@ -14,6 +14,9 @@ concurrency:
 jobs:
   markdown-link-check:
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      issues: write
     steps:
     - uses: actions/checkout@master
     - uses: gaurav-nelson/github-action-markdown-link-check@v1

.github/workflows/formatting.yml

@@ -17,6 +17,8 @@ jobs:
     name: cargo clippy
     runs-on: ubuntu-22.04
     timeout-minutes: 30
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout
@@ -45,6 +47,8 @@ jobs:
     name: cargo fmt
     runs-on: ubuntu-22.04
     timeout-minutes: 30
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout
@@ -71,6 +75,8 @@ jobs:
     name: cargo doc
     runs-on: ubuntu-22.04
     timeout-minutes: 30
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout
@@ -99,6 +105,8 @@ jobs:
     name: eslint
     runs-on: ubuntu-22.04
     timeout-minutes: 30
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout
@@ -115,6 +123,8 @@ jobs:
   build-nargo:
     runs-on: ubuntu-22.04
     timeout-minutes: 30
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout Noir repo
@@ -151,6 +161,8 @@ jobs:
     name: Nargo fmt
     runs-on: ubuntu-22.04
     timeout-minutes: 30
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout
@@ -180,6 +192,8 @@ jobs:
       - rustdoc
       - eslint
       - nargo_fmt
+    permissions:
+      contents: read
 
     steps:
         - name: Report overall success

.github/workflows/nightly-fuzz-test.yml

@@ -19,6 +19,8 @@ env:
 jobs:
   ast-fuzz:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@v5

.github/workflows/publish-acvm.yml

@@ -11,6 +11,8 @@ jobs:
   publish:
     name: Publish in order
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
     steps:
       - name: Checkout sources
         uses: actions/checkout@v5

.github/workflows/publish-docs.yml

@@ -11,6 +11,8 @@ jobs:
   publish-docs:
     name: Publish docs
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout release branch

.github/workflows/publish-nargo.yml

@@ -31,6 +31,8 @@ jobs:
       matrix:
         target: [x86_64-apple-darwin, aarch64-apple-darwin]
     timeout-minutes: 30
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout
@@ -128,6 +130,8 @@ jobs:
       matrix:
         target: [x86_64-unknown-linux-gnu, x86_64-unknown-linux-musl, aarch64-unknown-linux-gnu]
     timeout-minutes: 30
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout

.github/workflows/pull-request-title.yml

@@ -16,6 +16,8 @@ jobs:
   conventional-title:
     name: Validate PR title is Conventional Commit
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
     steps:
       - name: Check title
         if: github.event_name == 'pull_request_target'

.github/workflows/recrawler.yml

@@ -8,6 +8,8 @@ jobs:
   algolia_recrawl:
     name: Algolia Recrawl
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
     steps:
       - name: Algolia crawler creation and crawl
         uses: algolia/algoliasearch-crawler-github-actions@v1.1.0

.github/workflows/rustdoc.yml

@@ -14,6 +14,8 @@ jobs:
   build:
     name: Build
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
     steps:
       - name: Checkout repository
         uses: actions/checkout@v5
@@ -54,6 +56,8 @@ jobs:
     name: Deploy
     runs-on: ubuntu-22.04
     needs: build
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v5
         with:

.github/workflows/spellcheck.yml

@@ -11,6 +11,8 @@ jobs:
   code:
     name: Code
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
     steps:
       - name: Checkout sources
         uses: actions/checkout@v5
@@ -26,6 +28,8 @@ jobs:
   docs:
     name: Documentation
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
     steps:
       - name: Checkout sources
         uses: actions/checkout@v5