rest of the owl

Author: morganchen12

.github/workflows/android.yml

@@ -15,6 +15,9 @@ env:
   GITHUB_TOKEN: ${{ github.token }}
   xcodeVersion: "26.2"  # Only affects Mac runners, and only for prerequisites.
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref }}
   cancel-in-progress: true

.github/workflows/desktop.yml

@@ -14,6 +14,9 @@ env:
   CCACHE_DIR: ${{ github.workspace }}/ccache_dir
   GITHUB_TOKEN: ${{ github.token }}
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref }}
   cancel-in-progress: true
@@ -114,7 +117,9 @@ jobs:
 
       - name: Setup Xcode version (macos)
         if: runner.os == 'macOS'
-        run: sudo xcode-select -s /Applications/Xcode_${{ matrix.xcode_version }}.app/Contents/Developer
+        run: sudo xcode-select -s /Applications/Xcode_${XCODE_VERSION}.app/Contents/Developer
+        env:
+          XCODE_VERSION: ${{ matrix.xcode_version }}
 
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:

.github/workflows/ios.yml

@@ -13,6 +13,9 @@ on:
 env:
   GITHUB_TOKEN: ${{ github.token }}
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref }}
   cancel-in-progress: true
@@ -57,7 +60,9 @@ jobs:
 
       - name: setup Xcode version (macos)
         if: runner.os == 'macOS'
-        run: sudo xcode-select -s /Applications/Xcode_${{ matrix.xcode_version }}.app/Contents/Developer
+        run: sudo xcode-select -s /Applications/Xcode_${XCODE_VERSION}.app/Contents/Developer
+        env:
+          XCODE_VERSION: ${{ matrix.xcode_version }}
 
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:

.github/workflows/lint.yml

@@ -4,13 +4,19 @@ on:
   pull_request:
     types: [opened,synchronize]
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
   cancel-in-progress: true
 
 jobs:
   lint_warnings_check_and_comment:
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:

.github/workflows/retry-test-failures.yml

@@ -7,6 +7,9 @@ on:
         default: ''
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   check_results_and_retry_if_needed:
     name: check-results-and-retry-if-needed

.github/workflows/reviewer-roulette.yml

@@ -7,10 +7,16 @@ on:
 env:
   reviewerList: "jonsimantov a-maurice cynthiajoan chkuang-g AlmostMatt"
 
+permissions:
+  contents: read
+
 jobs:
   assign_random_reviewer:
     if: github.event.action == 'labeled' && github.event.label.name == 'reviewer-roulette'
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - name: Unset label
         uses: buildsville/add-remove-label@6008d7bd99d3baeb7c04033584e68f8ec80b198b # ratchet:buildsville/add-remove-label@v1

.github/workflows/update-custom-runner.yml

@@ -19,6 +19,9 @@ on:
 env:
   GITHUB_TOKEN: ${{ github.token }}
 
+permissions:
+  contents: read
+
 jobs:
   update_custom_runners:
     name: update-custom-runner-${{ matrix.runner_hostname }}