Enforce default permissions at the workflow level

.github/PklProject

@@ -2,5 +2,5 @@ amends "pkl:Project"
 
 dependencies {
   ["gha"] { uri = "package://pkg.pkl-lang.org/pkl-project-commons/temp.stefma.gha@0.0.0" }
-  ["pkl.impl.ghactions"] { uri = "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@0.2.0" }
+  ["pkl.impl.ghactions"] { uri = "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@0.3.2" }
 }

.github/PklProject.deps.json

@@ -10,9 +10,9 @@
     },
     "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@0": {
       "type": "remote",
-      "uri": "projectpackage://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@0.2.0",
+      "uri": "projectpackage://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@0.3.2",
       "checksums": {
-        "sha256": "2d593b831c63736bf55c1aa8ad3bc8dbbc86c974db963c38ba668fbcecd32a87"
+        "sha256": "3427c2349ba465e64e1d2e9ec1f71c079e7f98a0a5fcfe900df67c98daf7eebb"
       }
     }
   }

.github/workflows/build.yml

@@ -6,8 +6,11 @@ name: Build
   push:
     branches-ignore:
     - main
+    - release/*
     tags-ignore:
     - '*'
+permissions:
+  contents: read
 jobs:
   build-and-test:
     runs-on: ubuntu-latest

.github/workflows/main.yml

@@ -14,6 +14,8 @@ name: Build (main)
         description: The source GitHub Action workflow run triggering this build
         required: false
         type: string
+permissions:
+  contents: read
 jobs:
   publish:
     permissions:

.github/workflows/prb.yml

@@ -4,6 +4,8 @@
 name: Pull Request
 'on':
   pull_request: {}
+permissions:
+  contents: read
 jobs:
   build-and-test:
     runs-on: ubuntu-latest