ci: overly broad permissions

https://woodruffw.github.io/zizmor/audits/#excessive-permissions

.github/workflows/autofix.yml

@@ -1,5 +1,7 @@
 name: autofix.ci # For security reasons, the workflow in which the autofix.ci action is used must be named "autofix.ci".
 
+permissions: {}
+
 on:
   pull_request:
     types: [opened, synchronize]

.github/workflows/benchmark.yml

@@ -13,6 +13,8 @@
 
 name: Benchmark
 
+permissions: {}
+
 on:
   workflow_dispatch:
   pull_request:

.github/workflows/bloat.yml

@@ -2,6 +2,8 @@
 
 name: Cargo Bloat
 
+permissions: {}
+
 on:
   workflow_dispatch:
 

.github/workflows/cargo_llvm_lines.yml

@@ -2,6 +2,8 @@
 
 name: Cargo LLVM Lines
 
+permissions: {}
+
 on:
   workflow_dispatch:
 

.github/workflows/ci.yml

@@ -1,5 +1,7 @@
 name: CI
 
+permissions: {}
+
 on:
   workflow_dispatch:
   pull_request:

.github/workflows/ci_security.yml

@@ -1,5 +1,7 @@
 name: GitHub Actions Security Analysis
 
+permissions: {}
+
 on:
   workflow_dispatch:
   pull_request:

.github/workflows/ci_vscode.yml

@@ -1,5 +1,7 @@
 name: CI VSCode
 
+permissions: {}
+
 on:
   workflow_dispatch:
   pull_request:

.github/workflows/codecov.yml

@@ -2,6 +2,8 @@
 
 name: Code Coverage
 
+permissions: {}
+
 on:
   workflow_dispatch:
   push:

.github/workflows/deny.yml

@@ -1,5 +1,7 @@
 name: Cargo Deny
 
+permissions: {}
+
 on:
   workflow_dispatch:
   pull_request:

.github/workflows/link_check.yml

@@ -1,5 +1,7 @@
 name: Check Links
 
+permissions: {}
+
 on:
   workflow_dispatch:
   push:

.github/workflows/lint_rules.yml

@@ -1,5 +1,7 @@
 name: Update implementation status of all linter plugins
 
+permissions: {}
+
 on:
   push:
     branches:

.github/workflows/miri.yml

@@ -1,5 +1,7 @@
 name: Miri
 
+permissions: {}
+
 on:
   workflow_dispatch:
   pull_request:

.github/workflows/pr.yml

@@ -1,5 +1,7 @@
 name: Check PR
 
+permissions: {}
+
 on:
   pull_request_target: # zizmor: ignore[dangerous-triggers]
     types:

.github/workflows/prepare_release_crates.yml

@@ -1,5 +1,7 @@
 name: Prepare Release Crates
 
+permissions: {}
+
 on:
   workflow_dispatch:
 

.github/workflows/prepare_release_oxlint.yml

@@ -1,5 +1,7 @@
 name: Prepare Release Oxlint
 
+permissions: {}
+
 on:
   workflow_dispatch:
   push:

.github/workflows/release_crates.yml

@@ -1,5 +1,7 @@
 name: Release Crates
 
+permissions: {}
+
 on:
   workflow_dispatch:
   push:

.github/workflows/release_napi_minify.yml

@@ -1,5 +1,7 @@
 name: Release NAPI Minify
 
+permissions: {}
+
 on:
   push:
     branches:

.github/workflows/release_napi_parser.yml

@@ -1,5 +1,7 @@
 name: Release NAPI Parser
 
+permissions: {}
+
 on:
   push:
     branches:

.github/workflows/release_napi_transform.yml

@@ -1,5 +1,7 @@
 name: Release NAPI Transform
 
+permissions: {}
+
 on:
   push:
     branches:

.github/workflows/release_oxlint.yml

@@ -1,5 +1,7 @@
 name: Release Oxlint
 
+permissions: {}
+
 on:
   workflow_dispatch:
   push:

.github/workflows/release_types.yml

@@ -1,5 +1,7 @@
 name: Release @oxc-project/types
 
+permissions: {}
+
 on:
   workflow_dispatch:
   push:

.github/workflows/release_vscode.yml

@@ -1,7 +1,7 @@
-# Reference: https://github.com/biomejs/biome/blob/main/.github/workflows/release_lsp.yml
-
 name: Release VSCode
 
+permissions: {}
+
 on:
   push:
     branches:

.github/workflows/release_wasm.yml

@@ -1,5 +1,7 @@
 name: Release WASM
 
+permissions: {}
+
 on:
   workflow_dispatch:
   push:

.github/workflows/reusable_prepare_release.yml

@@ -1,5 +1,7 @@
 name: Prepare Release
 
+permissions: {}
+
 on:
   workflow_call:
     inputs:

.github/workflows/reusable_release_napi.yml

@@ -1,5 +1,7 @@
 name: Release NAPI
 
+permissions: {}
+
 on:
   workflow_call:
     inputs: