diff --git a/.github/workflows/aarch64_linux_bazel.yml b/.github/workflows/aarch64_linux_bazel.yml
index 25f87157..fedfd955 100644
--- a/.github/workflows/aarch64_linux_bazel.yml
+++ b/.github/workflows/aarch64_linux_bazel.yml
@@ -7,6 +7,9 @@ on:
     # min hours day(month) month day(week)
     - cron: '0 0 7,22 * *'
 
+permissions:
+  contents: read
+
 jobs:
   # Building using the GitHub runner environement directly.
   bazel:
diff --git a/.github/workflows/aarch64_linux_cmake.yml b/.github/workflows/aarch64_linux_cmake.yml
index 5bd422bd..7872b7ef 100644
--- a/.github/workflows/aarch64_linux_cmake.yml
+++ b/.github/workflows/aarch64_linux_cmake.yml
@@ -7,6 +7,9 @@ on:
     # min hours day(month) month day(week)
     - cron: '0 0 7,22 * *'
 
+permissions:
+  contents: read
+
 jobs:
   # Building using the github runner environement directly.
   make:
diff --git a/.github/workflows/aarch64_linux_zig.yml b/.github/workflows/aarch64_linux_zig.yml
index e1e59d57..e673e3d3 100644
--- a/.github/workflows/aarch64_linux_zig.yml
+++ b/.github/workflows/aarch64_linux_zig.yml
@@ -2,6 +2,9 @@ name: aarch64 Linux Zig
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   run:
     strategy:
diff --git a/.github/workflows/amd64_linux_bazel.yml b/.github/workflows/amd64_linux_bazel.yml
index 4ed4e852..a156f8a2 100644
--- a/.github/workflows/amd64_linux_bazel.yml
+++ b/.github/workflows/amd64_linux_bazel.yml
@@ -7,6 +7,9 @@ on:
     # min hours day(month) month day(week)
     - cron: '0 0 7,22 * *'
 
+permissions:
+  contents: read
+
 jobs:
   # Building using the github runner environement directly.
   bazel:
diff --git a/.github/workflows/amd64_linux_cmake.yml b/.github/workflows/amd64_linux_cmake.yml
index eed4d018..5b300540 100644
--- a/.github/workflows/amd64_linux_cmake.yml
+++ b/.github/workflows/amd64_linux_cmake.yml
@@ -7,6 +7,9 @@ on:
     # min hours day(month) month day(week)
     - cron: '0 0 7,22 * *'
 
+permissions:
+  contents: read
+
 jobs:
   # Building using the github runner environement directly.
   make:
diff --git a/.github/workflows/amd64_linux_zig.yml b/.github/workflows/amd64_linux_zig.yml
index bf99754f..b2eb946b 100644
--- a/.github/workflows/amd64_linux_zig.yml
+++ b/.github/workflows/amd64_linux_zig.yml
@@ -2,6 +2,9 @@ name: amd64 Linux Zig
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   run:
     strategy:
diff --git a/.github/workflows/amd64_macos_bazel.yml b/.github/workflows/amd64_macos_bazel.yml
index e5c2a804..5e835b46 100644
--- a/.github/workflows/amd64_macos_bazel.yml
+++ b/.github/workflows/amd64_macos_bazel.yml
@@ -8,6 +8,9 @@ on:
     # min hours day(month) month day(week)
     - cron: '0 0 7,22 * *'
 
+permissions:
+  contents: read
+
 jobs:
   # Building using the github runner environement directly.
   bazel:
diff --git a/.github/workflows/amd64_macos_cmake.yml b/.github/workflows/amd64_macos_cmake.yml
index d95dc08e..b0f50037 100644
--- a/.github/workflows/amd64_macos_cmake.yml
+++ b/.github/workflows/amd64_macos_cmake.yml
@@ -8,6 +8,9 @@ on:
     # min hours day(month) month day(week)
     - cron: '0 0 7,22 * *'
 
+permissions:
+  contents: read
+
 jobs:
   # Building using the github runner environement directly.
   xcode:
diff --git a/.github/workflows/amd64_macos_zig.yml b/.github/workflows/amd64_macos_zig.yml
index 4fde639b..eeb6468e 100644
--- a/.github/workflows/amd64_macos_zig.yml
+++ b/.github/workflows/amd64_macos_zig.yml
@@ -2,6 +2,9 @@ name: amd64 MacOS Zig
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   run:
     strategy:
diff --git a/.github/workflows/amd64_windows_bazel.yml b/.github/workflows/amd64_windows_bazel.yml
index d61cf792..7f269fb7 100644
--- a/.github/workflows/amd64_windows_bazel.yml
+++ b/.github/workflows/amd64_windows_bazel.yml
@@ -8,6 +8,9 @@ on:
     # min hours day(month) month day(week)
     - cron: '0 0 7,22 * *'
 
+permissions:
+  contents: read
+
 jobs:
   # Building using the github runner environement directly.
   bazel:
diff --git a/.github/workflows/amd64_windows_cmake.yml b/.github/workflows/amd64_windows_cmake.yml
index 176d7c0f..a4d67c36 100644
--- a/.github/workflows/amd64_windows_cmake.yml
+++ b/.github/workflows/amd64_windows_cmake.yml
@@ -7,6 +7,9 @@ on:
     # min hours day(month) month day(week)
     - cron: '0 0 7,22 * *'
 
+permissions:
+  contents: read
+
 jobs:
   # Building using the github runner environement directly.
   msvc:
diff --git a/.github/workflows/amd64_windows_zig.yml b/.github/workflows/amd64_windows_zig.yml
index d1f835a7..6ce634af 100644
--- a/.github/workflows/amd64_windows_zig.yml
+++ b/.github/workflows/amd64_windows_zig.yml
@@ -2,6 +2,9 @@ name: amd64 Windows Zig
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   run:
     strategy:
diff --git a/.github/workflows/arm64_macos_bazel.yml b/.github/workflows/arm64_macos_bazel.yml
index 01bc2846..0f7d282c 100644
--- a/.github/workflows/arm64_macos_bazel.yml
+++ b/.github/workflows/arm64_macos_bazel.yml
@@ -8,6 +8,9 @@ on:
     # min hours day(month) month day(week)
     - cron: '0 0 7,22 * *'
 
+permissions:
+  contents: read
+
 jobs:
   # Building using the github runner environement directly.
   bazel:
diff --git a/.github/workflows/arm64_macos_cmake.yml b/.github/workflows/arm64_macos_cmake.yml
index 749c18a2..55267fcc 100644
--- a/.github/workflows/arm64_macos_cmake.yml
+++ b/.github/workflows/arm64_macos_cmake.yml
@@ -8,6 +8,9 @@ on:
     # min hours day(month) month day(week)
     - cron: '0 0 7,22 * *'
 
+permissions:
+  contents: read
+
 jobs:
   # Building using the github runner environement directly.
   xcode:
diff --git a/.github/workflows/arm64_macos_zig.yml b/.github/workflows/arm64_macos_zig.yml
index d6bb0f41..a51d26f7 100644
--- a/.github/workflows/arm64_macos_zig.yml
+++ b/.github/workflows/arm64_macos_zig.yml
@@ -2,6 +2,9 @@ name: Arm64 MacOS Zig
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   run:
     strategy:
diff --git a/.github/workflows/arm_linux_cmake.yml b/.github/workflows/arm_linux_cmake.yml
index 3430401f..0a061dd2 100644
--- a/.github/workflows/arm_linux_cmake.yml
+++ b/.github/workflows/arm_linux_cmake.yml
@@ -7,6 +7,9 @@ on:
     # min hours day(month) month day(week)
     - cron: '0 0 7,22 * *'
 
+permissions:
+  contents: read
+
 jobs:
   # Building using the github runner environement directly.
   make:
diff --git a/.github/workflows/clang_format.yml b/.github/workflows/clang_format.yml
index c87fab20..5cb43fc5 100644
--- a/.github/workflows/clang_format.yml
+++ b/.github/workflows/clang_format.yml
@@ -2,6 +2,9 @@ name: clang-format Check
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   # Building using the github runner environement directly.
   clang-format:
diff --git a/.github/workflows/mips_linux_cmake.yml b/.github/workflows/mips_linux_cmake.yml
index f6d7d957..82964e09 100644
--- a/.github/workflows/mips_linux_cmake.yml
+++ b/.github/workflows/mips_linux_cmake.yml
@@ -7,6 +7,9 @@ on:
     # min hours day(month) month day(week)
     - cron: '0 0 7,22 * *'
 
+permissions:
+  contents: read
+
 jobs:
   # Building using the github runner environement directly.
   make:
diff --git a/.github/workflows/power_linux_cmake.yml b/.github/workflows/power_linux_cmake.yml
index 211c9c59..8c329d10 100644
--- a/.github/workflows/power_linux_cmake.yml
+++ b/.github/workflows/power_linux_cmake.yml
@@ -7,6 +7,9 @@ on:
     # min hours day(month) month day(week)
     - cron: '0 0 7,22 * *'
 
+permissions:
+  contents: read
+
 jobs:
   # Building using the github runner environement directly.
   make:
diff --git a/.github/workflows/riscv_linux_cmake.yml b/.github/workflows/riscv_linux_cmake.yml
index 89a8ad57..6cc0a279 100644
--- a/.github/workflows/riscv_linux_cmake.yml
+++ b/.github/workflows/riscv_linux_cmake.yml
@@ -7,6 +7,9 @@ on:
     # min hours day(month) month day(week)
     - cron: '0 0 7,22 * *'
 
+permissions:
+  contents: read
+
 jobs:
   # Building using the github runner environement directly.
   make:
diff --git a/.github/workflows/s390x_linux_cmake.yml b/.github/workflows/s390x_linux_cmake.yml
index 788768d6..fb31b98c 100644
--- a/.github/workflows/s390x_linux_cmake.yml
+++ b/.github/workflows/s390x_linux_cmake.yml
@@ -7,6 +7,9 @@ on:
     # min hours day(month) month day(week)
     - cron: '0 0 7,22 * *'
 
+permissions:
+  contents: read
+
 jobs:
   # Building using the github runner environement directly.
   make:
diff --git a/.github/workflows/zig.yml b/.github/workflows/zig.yml
index c8298e7d..61efb30a 100644
--- a/.github/workflows/zig.yml
+++ b/.github/workflows/zig.yml
@@ -2,6 +2,9 @@ name: Zig Check
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   zig-fmt:
     runs-on: ubuntu-latest