Set token permissions in workflows.

.github/workflows/linux_auto_assign_author.yaml

@@ -1,5 +1,6 @@
 # Automatically assigns the author who created the PR to the Assignees in GitHub.
 name: PR Author Assign
+permissions: read-all
 
 on:
   pull_request_target:
@@ -14,4 +15,4 @@ jobs:
     steps:
       - uses: toshimaru/[email protected]
         with:
-          repo-token: "${{ secrets.GITHUB_TOKEN }}"
+          repo-token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/linux_clang_format_check.yaml

@@ -1,4 +1,5 @@
 name: "Clang format check"
+permissions: read-all
 
 on:
   push:

.github/workflows/linux_publish_api_docs.yaml

@@ -1,4 +1,5 @@
 name: "Build and Publish API Documentation"
+permissions: read-all
 
 on:
   push:

.github/workflows/win_auto_roll.yaml

@@ -4,6 +4,7 @@
 # once the integration tests become green.
 # Any new dependencies in .\DEPS should also be added here.
 name: 'Auto Roll DEPS'
+permissions: read-all
 
 on:
   workflow_dispatch:

.github/workflows/win_x64_cmake_msvc_dbg.yaml

@@ -1,4 +1,5 @@
 name: Windows x64 CMake/MSVC (Debug)
+permissions: read-all
 
 on:
   # This is a required workflow specified in branch enforcement

.github/workflows/win_x64_cmake_msvc_rel.yaml

@@ -1,4 +1,5 @@
 name: Windows x64 CMake/MSVC (Release)
+permissions: read-all
 
 on:
   # This is a required workflow specified in branch enforcement

.github/workflows/win_x64_gn_clang_dbg.yaml

@@ -1,4 +1,5 @@
 name: Windows x64 GN/Clang (Debug)
+permissions: read-all
 
 on:
   # This is a required workflow specified in branch enforcement

.github/workflows/win_x64_gn_clang_dbg_dawn.yaml

@@ -1,4 +1,5 @@
 name: Windows x64 GN/Clang WebGPU/Dawn (Debug)
+permissions: read-all
 
 on:
   workflow_dispatch:

.github/workflows/win_x64_gn_clang_rel.yaml

@@ -1,4 +1,5 @@
 name: Windows x64 GN/Clang (Release)
+permissions: read-all
 
 on:
   # This is a required workflow specified in branch enforcement

.github/workflows/win_x64_gn_clang_rel_dawn.yaml

@@ -1,4 +1,5 @@
 name: Windows x64 GN/Clang WebGPU/Dawn (Release)
+permissions: read-all
 
 on:
   push:

.github/workflows/win_x64_gn_msvc_dbg.yaml

@@ -1,4 +1,5 @@
 name: Windows x64 GN/MSVC (Debug)
+permissions: read-all
 
 on:
   # This is a required workflow specified in branch enforcement

.github/workflows/win_x64_gn_msvc_rel.yaml

@@ -1,4 +1,5 @@
 name: Windows x64 GN/MSVC (Release)
+permissions: read-all
 
 on:
   # This is a required workflow specified in branch enforcement

.github/workflows/win_x86_gn_clang_dbg.yaml

@@ -1,4 +1,5 @@
 name: Windows x86 GN/Clang (Debug)
+permissions: read-all
 
 on:
   # This is a required workflow specified in branch enforcement

.github/workflows/win_x86_gn_clang_rel.yaml

@@ -1,4 +1,5 @@
 name: Windows x86 GN/Clang (Release)
+permissions: read-all
 
 on:
   # This is a required workflow specified in branch enforcement