ci: refactor

.github/workflows/allocator-bench.yml

@@ -10,8 +10,6 @@ jobs:
   bench:
     name: ${{ matrix.platform }} (tokio-multi-thread=${{ matrix.tokio_multi_thread }}, ${{ matrix.allocator }})
     runs-on: ${{ matrix.runner }}
-    permissions:
-      contents: read
     strategy:
       fail-fast: false
       matrix:

.github/workflows/ci.yml

@@ -7,6 +7,8 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
+permissions:
+  contents: read
 jobs:
   check:
     if: ${{ always() && github.event_name == 'pull_request' }}
@@ -229,8 +231,6 @@ jobs:
           #   cross: true
       fail-fast: false
     runs-on: ${{ matrix.runner }}
-    permissions:
-      contents: read
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
@@ -330,8 +330,6 @@ jobs:
     needs:
       - upload-docker-manifest
     runs-on: ubuntu-24.04
-    permissions:
-      contents: read
     strategy:
       matrix:
         platform:
@@ -382,8 +380,6 @@ jobs:
           - "s390x"
       fail-fast: false
     runs-on: ubuntu-24.04
-    permissions:
-      contents: read
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
@@ -399,8 +395,6 @@ jobs:
           include-hidden-files: true
   clippy:
     runs-on: ubuntu-24.04
-    permissions:
-      contents: read
     strategy:
       matrix:
         include:
@@ -470,8 +464,6 @@ jobs:
       - run: cargo +beta clippy --all-targets ${{ matrix.features }} -- -Dwarnings
   pre-commit:
     runs-on: ubuntu-24.04
-    permissions:
-      contents: read
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
@@ -483,8 +475,6 @@ jobs:
       - run: uv tool run --exclude-newer '3 days' --no-cache prek run --all-files --show-diff-on-failure
   rustfmt:
     runs-on: ubuntu-24.04
-    permissions:
-      contents: read
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
@@ -497,8 +487,6 @@ jobs:
       - run: cargo +nightly fmt --check
   udeps:
     runs-on: ubuntu-24.04
-    permissions:
-      contents: read
     strategy:
       matrix:
         features: