ci(repo): add least-privilege permissions to GitHub Actions workflows

.github/workflows/beta_version_analyze.yml

@@ -6,6 +6,9 @@ on:
     - cron: '0 2 * * 1'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   # Does a sanity check on packages for the next beta version so we are not surprised by any breaking changes.
   analyze_beta_versions:

.github/workflows/distribute_external.yml

@@ -22,6 +22,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   determine_platforms:
     runs-on: ubuntu-latest

.github/workflows/distribute_internal.yml

@@ -25,6 +25,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   determine_platforms:
     runs-on: ubuntu-latest

.github/workflows/legacy_version_analyze.yml

@@ -17,6 +17,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   # Centralizes every gating decision for this workflow — path filter, draft
   # state, and push-vs-PR semantics. Downstream jobs only need a single

.github/workflows/pana.yml

@@ -12,6 +12,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   stream_chat:
     runs-on: ubuntu-latest

.github/workflows/pr_title.yml

@@ -13,6 +13,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   conventional_pr_title:
     runs-on: ubuntu-latest

.github/workflows/stream_flutter_workflow.yml

@@ -19,6 +19,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   # Centralizes every gating decision for this workflow — path filter,
   # draft state, and push-vs-PR semantics. Downstream jobs only need a

.github/workflows/update_goldens.yml

@@ -13,6 +13,9 @@ on:
           - sdk
           - docs
 
+permissions:
+  contents: write
+
 jobs:
   update_sdk_goldens:
     if: inputs.target == 'sdk' || inputs.target == 'both'