set read permissions for all workflows and set check-js-build to run on pr synchronize

Author: emilykl

.github/workflows/build-doc.yml

@@ -7,6 +7,9 @@ on:
   pull_request:
     types: [opened, reopened, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   build-doc:
     runs-on: ubuntu-latest

.github/workflows/build-package.yml

@@ -7,6 +7,9 @@ on:
   pull_request:
     types: [opened, reopened, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   plotlyjs-dev-build:
     name: plotly.js dev build

.github/workflows/check-codegen.yml

@@ -7,6 +7,9 @@ on:
   pull_request:
     types: [opened, reopened, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   check-python-codegen:
     name: Check Python codegen

.github/workflows/check-formatting.yml

@@ -7,6 +7,9 @@ on:
   pull_request:
     types: [opened, reopened, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   check-code-formatting:
     name: Run ruff check

.github/workflows/check-js-build.yml

@@ -3,13 +3,16 @@ on:
     branches:
       - main
   pull_request:
-    types: [opened, reopened]
+    types: [opened, reopened, synchronize]
     paths:
       - 'js/**'
       - 'plotly/labextension/**'
 
 name: Check JS build
 
+permissions:
+  contents: read
+
 jobs:
   check-js-build:
     name: Check JS version number and build artifacts

.github/workflows/run-percy.yml

@@ -8,6 +8,9 @@ on:
     types: [opened, reopened, synchronize]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   python-311-percy:
     name: Run Percy

.github/workflows/run-pytest.yml

@@ -7,6 +7,9 @@ on:
   pull_request:
     types: [opened, reopened, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   test-core:
     name: Core tests (Python ${{ matrix.python-version }})

.github/workflows/test-release.yml

@@ -3,6 +3,9 @@ name: Test release
 on:
   workflow_dispatch
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Full prod build