Adding GitHub content protection rule to CI

.github/workflows/black.yaml

@@ -2,17 +2,20 @@ name: black
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 # use workaround due to: https://github.com/psf/black/issues/2079#issuecomment-812359146
 jobs:
-    check-formatting:
-        runs-on: ubuntu-24.04
-        steps:
-            - uses: actions/checkout@v2
-            - name: Set up Python 3.11
-              uses: actions/setup-python@v2
-              with:
-                python-version: '3.11'
-            - name: Install Black
-              run: pip install 'black==22.6.0'
-            - name: Run black --check .
-              run: black --check .
+  check-formatting:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v2
+        with:
+          python-version: '3.11'
+      - name: Install Black
+        run: pip install 'black==22.6.0'
+      - name: Run black --check .
+        run: black --check .

.github/workflows/coverage.yaml

@@ -1,5 +1,8 @@
 name: Coverage
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:

.github/workflows/licensechecker.yaml

@@ -1,5 +1,10 @@
 name: Check License Lines
+
+permissions:
+  contents: read
+
 on: [push, pull_request]
+
 jobs:
   check-license-lines:
     runs-on: ubuntu-24.04

.github/workflows/linting.yaml

@@ -1,5 +1,8 @@
 name: Linting
 
+permissions:
+  contents: read
+
 on: [push, pull_request]
 
 jobs:

.github/workflows/mac_tests.yaml

@@ -1,5 +1,8 @@
 name: ARMI MacOS Tests
 
+permissions:
+  contents: read
+
 on:
   push:
     paths-ignore:

.github/workflows/unittests.yaml

@@ -1,5 +1,8 @@
 name: ARMI unit tests
 
+permissions:
+  contents: read
+
 on:
   push:
     paths-ignore:

.github/workflows/validatemanifest.yaml

@@ -1,5 +1,8 @@
 name: Validate Manifest
 
+permissions:
+  contents: read
+
 on: [push, pull_request]
 
 jobs:

.github/workflows/wintests.yaml

@@ -1,5 +1,8 @@
 name: ARMI Windows tests
 
+permissions:
+  contents: read
+
 on:
   push:
     paths-ignore: