Set default workflow permissions

.github/workflows/ci-build-checks.yaml

@@ -7,10 +7,10 @@
 # https://github.com/tensorflow/quantum/actions/workflows/ci-build-checks.yaml
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 name: CI build checks
 run-name: Continuous integration build & test
 
 on:
   pull_request:
     types: [opened, synchronize]
     branches:
@@ -85,11 +85,14 @@
     ^\.github/problem-matchers/.*
     ^benchmarks/.*
 
+# Cancel any previously-started but still active runs on the same branch.
 concurrency:
-  # Cancel any previously-started but still active runs on the same branch.
   cancel-in-progress: true
   group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}}
 
+# Declare default permissions as read-only.
+permissions: read-all
+
 jobs:
   # Summary of basic strategy:
   #   1. Job "Decision" quickly determines if the rest of the workflow needs

.github/workflows/ci-file-checks.yaml

@@ -12,10 +12,10 @@
 # https://github.com/tensorflow/quantum/actions/workflows/ci-file-checks.yaml
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 name: CI file checks
 run-name: Continuous integration file checks
 
 on:
   pull_request:
     types: [opened, synchronize]
     branches:
@@ -65,11 +65,14 @@
   # GitHub, and you have to use Ubuntu 24 to get it.
   clang_format_ver: '18'
 
+# Cancel any previously-started but still active runs on the same branch.
 concurrency:
-  # Cancel any previously-started but still active runs on the same branch.
   cancel-in-progress: true
   group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}}
 
+# Declare default permissions as read-only.
+permissions: read-all
+
 jobs:
   Changes:
     runs-on: ubuntu-24.04

.github/workflows/ci-nightly-build-test.yaml

@@ -14,10 +14,10 @@
 # https://github.com/tensorflow/quantum/actions/workflows/ci-build-checks.yaml
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 name: CI nightly full test
 run-name: Continuous integration nightly build & test
 
 on:
   schedule:
     - cron: "15 6 * * *"
 
@@ -49,11 +49,14 @@
     test --test_timeout=6000
     test --test_verbose_timeout_warnings
 
+# Cancel any previously-started but still active runs on the same branch.
 concurrency:
-  # Cancel any previously-started but still active runs on the same branch.
   cancel-in-progress: true
   group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}}
 
+# Declare default permissions as read-only.
+permissions: read-all
+
 jobs:
   Decision:
     runs-on: ubuntu-24.04

.github/workflows/ci-nightly-cirq-test.yaml

@@ -9,10 +9,10 @@
 # options for overridding some of the parameters for the run.
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 name: CI nightly Cirq compatibility test
 run-name: Continuous integration Cirq compatibility test
 
 on:
   schedule:
     - cron: "10 7 * * *"
 
@@ -64,11 +64,14 @@
     build --verbose_failures
     test --test_timeout=3000
 
+# Cancel any previously-started but still active runs on the same branch.
 concurrency:
-  # Cancel any previously-started but still active runs on the same branch.
   cancel-in-progress: true
   group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}}
 
+# Declare default permissions as read-only.
+permissions: read-all
+
 jobs:
   test-compatibility:
     name: Run TFQ tests
@@ -99,13 +102,13 @@
           # If we didn't get a cache hit on the installed Python environment,
           # something's changed, and we want to make sure to re-run all tests.
           if [[ "${{steps.python.outputs.cache-hit}}" == "true"
                  && "${{github.event.inputs.cache_bazel_tests}}" != "false" ]]; then
             echo "cache_bazel_tests=auto" >> "$GITHUB_ENV"
           else
             echo "cache_bazel_tests=no" >> "$GITHUB_ENV"
           fi
           # Use the disk cache unless told not to.
           if [[ "${{github.event.inputs.use_bazel_disk_cache}}" != "false" ]]; then
             echo "use_bazel_disk_cache=true" >> "$GITHUB_ENV"
           else
             echo "use_bazel_disk_cache=false" >> "$GITHUB_ENV"