Default GHA permissions to contents: read

[hugovk]

Follow on from #148114, so GitHub Actions can run in private forks:

#148114 (comment)

[hugovk]

build.yml failed in my fork:

Invalid workflow file: .github/workflows/build.yml#L608 The workflow is not valid. .github/workflows/build.yml (Line: 608, Col: 3): Error calling workflow 'hugovk/cpython/.github/workflows/reusable-cifuzz.yml@a959dde4ca2a991f711a79b2c94f0cf2bf127b0a'. The workflow is requesting 'contents: read', but is only allowed 'contents: none'.

https://github.com/hugovk/cpython/actions/runs/24252340106

I think this will pass when merged, because it won't have the mismatch between main and the branch?

[webknjaz]

@hugovk you may want to adjust line 616

[hugovk]

@webknjaz This one?

https://github.com/hugovk/cpython/blob/a959dde4ca2a991f711a79b2c94f0cf2bf127b0a/.github/workflows/build.yml#L616

Adjust how?

[webknjaz]

Yep, add contents: read there. The calling workflow sets contents: none but the reusable one wants higher privileges, which is what that error is about.