ci: set explicit workflow permissions (#31830)

* Set explicit workflow permissions
* Should be a no-op since we're using restricted GITHUB_TOKENs by
default

.github/workflows/_compile_integration_test.yml

@@ -12,6 +12,9 @@ on:
         type: string
         description: "Python version to use"
 
+permissions:
+  contents: read
+
 env:
   UV_FROZEN: "true"
 

.github/workflows/_integration_test.yml

@@ -12,6 +12,9 @@ on:
         type: string
         description: "Python version to use"
 
+permissions:
+  contents: read
+
 env:
   UV_FROZEN: "true"
 

.github/workflows/_lint.yml

@@ -12,6 +12,9 @@ on:
         type: string
         description: "Python version to use"
 
+permissions:
+  contents: read
+
 env:
   WORKDIR: ${{ inputs.working-directory == '' && '.' || inputs.working-directory }}
 

.github/workflows/_test.yml

@@ -12,6 +12,9 @@ on:
         type: string
         description: "Python version to use"
 
+permissions:
+  contents: read
+
 env:
   UV_FROZEN: "true"
   UV_NO_SYNC: "true"

.github/workflows/_test_doc_imports.yml

@@ -8,6 +8,9 @@ on:
         type: string
         description: "Python version to use"
 
+permissions:
+  contents: read
+
 env:
   UV_FROZEN: "true"
 

.github/workflows/_test_pydantic.yml

@@ -17,6 +17,9 @@ on:
         type: string
         description: "Pydantic version to test."
 
+permissions:
+  contents: read
+
 env:
   UV_FROZEN: "true"
   UV_NO_SYNC: "true"

.github/workflows/check-broken-links.yml

@@ -5,6 +5,9 @@ on:
   schedule:
     - cron:  '0 13 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   check-links:
     if: github.repository_owner == 'langchain-ai' || github.event_name != 'schedule'

.github/workflows/check_core_versions.yml

@@ -6,6 +6,9 @@ on:
       - 'libs/core/pyproject.toml'
       - 'libs/core/langchain_core/version.py'
 
+permissions:
+  contents: read
+
 jobs:
   check_version_equality:
     runs-on: ubuntu-latest

.github/workflows/check_diffs.yml

@@ -16,6 +16,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 env:
   UV_FROZEN: "true"
   UV_NO_SYNC: "true"

.github/workflows/check_new_docs.yml

@@ -15,6 +15,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/codspeed.yml

@@ -7,6 +7,9 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 env:
   AZURE_OPENAI_CHAT_DEPLOYMENT_NAME: foo
   AZURE_OPENAI_LEGACY_CHAT_DEPLOYMENT_NAME: foo

.github/workflows/people.yml

@@ -11,7 +11,8 @@ jobs:
   langchain-people:
     if: github.repository_owner == 'langchain-ai' || github.event_name != 'schedule'
     runs-on: ubuntu-latest
-    permissions: write-all
+    permissions:
+      contents: write
     steps:
       - name: Dump GitHub context
         env:

.github/workflows/run_notebooks.yml

@@ -14,6 +14,9 @@ on:
   schedule:
     - cron: '0 13 * * *'
 
+permissions:
+  contents: read
+
 env:
   UV_FROZEN: "true"
 

.github/workflows/scheduled_test.yml

@@ -12,6 +12,9 @@ on:
   schedule:
     - cron:  '0 13 * * *'
 
+permissions:
+  contents: read
+
 env:
   POETRY_VERSION: "1.8.4"
   UV_FROZEN: "true"