ci: declare workflow-level contents: read on 3 workflows

[arpitjain099]

Pins the default GITHUB_TOKEN to contents: read on 3 workflows in .github/workflows/ that don't call a GitHub API beyond the initial checkout.

Why

CVE-2025-30066 (March 2025 tj-actions/changed-files supply-chain compromise) exfiltrated GITHUB_TOKEN from workflow logs. Pinning per workflow caps runtime authority irrespective of the repo or org default, gives drift protection if the default ever widens, and is credited per-file by the OpenSSF Scorecard Token-Permissions check.

YAML validated locally with yaml.safe_load on each touched file.

[lumirlumir]

As mentioned in eslint/rewrite#452 (review), could you take a look at the CI failure?

[arpitjain099]

Indent fix (4-space) + rebase on main pushed; same shape as the rewrite#452 fix. Let me know if anything else.

[lumirlumir]

Thanks for the update. I think the CI failure isn’t related to this change, and it also fails on the main branch. I’ll open a separate PR to resolve it shortly.

[arpitjain099]

Quick read on the CI failure - the failing job (ci-package-manager / pnpm-install) is hitting [ERR_PNPM_IGNORED_BUILDS] Ignored build scripts: yo@7.0.1. That's pnpm 10+ refusing to run yo's install-time build script by default. It's unrelated to the workflow-permissions diff in this PR (the failing step runs inside the upstream reusable workflow eslint/workflows/.github/workflows/ci-package-manager.yml, and it fails on main too with this config).

The fix would live in package.json on this repo - something like:

"pnpm": {
  "onlyBuiltDependencies": ["yo"]
}

Happy to roll that into this PR if you'd prefer one PR, or leave it as a separate small fix - your call. Other repos in the batch don't hit this since they don't pull in yeoman.

[lumirlumir]

@arpitjain099 Thanks for looking into it. I opened a PR to resolve that issue about five days ago at #270, so let’s wait a bit for that PR to be merged :)

[lumirlumir]

Could you rebase this branch once so that the CI failure is fixed?

[arpitjain099]

Rebased onto main - the CI failure should be cleared now. Thanks @lumirlumir!