ci: declare read-only GitHub token permissions for workflows

[leocagli]

Closes #249

Every workflow now declares contents: read at workflow level. Nothing else changed.

What was there before

None of the four workflows declared a permissions block, so all four inherited the repository default, which is broader than what these jobs use:

workflow	before	after
bindings-check.yml	inherited default	contents: read
contract.yml	inherited default	contents: read
coverage.yml	inherited default	contents: read
docs-links.yml	inherited default	contents: read

Why contents: read is enough

I checked this before lowering anything, since a workflow that actually writes would break on its next run rather than at merge time. Across all four workflows there is:

• no git push, no gh pr / gh issue / gh release
• no reference to GITHUB_TOKEN and no secrets.*
• no deploy or pages-upload step

The complete set of actions used is actions/checkout@v4, actions/setup-node@v4, pnpm/action-setup@v4, dtolnay/rust-toolchain@stable and Swatinem/rust-cache@v2. All read-only.

Placement and validation

The block goes after the on: section and before the next top-level key, so it reads where a reviewer expects it.

All four parse after the change, with triggers and jobs unchanged:

bindings-check.yml  permissions={'contents': 'read'}  jobs=['check']          triggers=['push', 'pull_request']
contract.yml        permissions={'contents': 'read'}  jobs=['round-contract'] triggers=['push', 'pull_request']
coverage.yml        permissions={'contents': 'read'}  jobs=['coverage']       triggers=['push', 'pull_request']
docs-links.yml      permissions={'contents': 'read'}  jobs=['check-links']    triggers=['push', 'pull_request']

One thing worth knowing for later

This makes the workflow-level grant explicit, so any future job that needs to write (commenting on a PR, pushing bindings, publishing) will have to declare its own job-level permissions. That is the intended trade: it fails loudly at the job that needs it instead of quietly having write access everywhere.

No action versions, triggers, job names or commands were touched.

🤖 Generated with Claude Code