ci: declare least-privilege workflow permissions

Jobs without a permissions block inherit the repository default token
scope. Scopes are derived from what each workflow actually does with
the token:

- the fourteen package build and test workflows plus the code linter
  never write through the token, they drop to contents: read.
- lint-pr-title.yml gets pull-requests: read, which is what the
  semantic PR title action documents needing.
- comment-icon-preview.yml runs on workflow_run, a privileged trigger
  processing artifacts produced by fork PRs, so an exact scope matters
  most there: actions: read to download the artifact, issues: write
  plus pull-requests: write to post the preview comment, contents:
  read for the rest.

The workflows that already declared scoped permissions (labeler,
stale, linting-icons, release and friends) are untouched.

.github/workflows/angular.yml

@@ -7,6 +7,9 @@ on:
       - tools/build-icons/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/comment-icon-preview.yml

@@ -6,6 +6,14 @@ on:
     types:
       - completed
 
+permissions:
+  contents: read
+  # Download the pr_number artifact from the triggering run.
+  actions: read
+  # Create or update the icon preview comment on the PR.
+  issues: write
+  pull-requests: write
+
 jobs:
   upload:
     runs-on: ubuntu-latest

.github/workflows/icons.yml

@@ -9,6 +9,9 @@ on:
       - tools/rollup-plugins/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/lint-code.yml

@@ -3,6 +3,9 @@ name: Linting PR code
 on:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   lint-code:
     runs-on: ubuntu-latest

.github/workflows/lint-pr-title.yml

@@ -7,6 +7,10 @@ on:
       - edited
       - reopened
 
+permissions:
+  # The semantic PR action only reads the pull request title.
+  pull-requests: read
+
 jobs:
   lint-pr-title:
     name: PR Title Lint

.github/workflows/lucide-astro.yml

@@ -11,6 +11,9 @@ on:
       - tools/build-icons/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/lucide-font.yml

@@ -9,6 +9,9 @@ on:
       - tools/build-font/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   lucide-font:
     runs-on: ubuntu-latest

.github/workflows/lucide-preact.yml

@@ -12,6 +12,9 @@ on:
       - tools/rollup-plugins/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   lucide-preact:
     runs-on: ubuntu-latest

.github/workflows/lucide-react-native.yml

@@ -12,6 +12,9 @@ on:
       - tools/rollup-plugins/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/lucide-react.yml

@@ -13,6 +13,9 @@ on:
       - scripts/generateNextJSAliases.mjs
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/lucide-shared.yml

@@ -9,6 +9,9 @@ on:
       - packages/shared/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest

.github/workflows/lucide-solid.yml

@@ -12,6 +12,9 @@ on:
       - tools/rollup-plugins/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/lucide-static.yml

@@ -7,6 +7,9 @@ on:
       - tools/build-icons/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   lucide-static:
     runs-on: ubuntu-latest

.github/workflows/lucide-svelte-5.yml

@@ -12,6 +12,9 @@ on:
       - tools/rollup-plugins/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/lucide-vue.yml

@@ -12,6 +12,9 @@ on:
       - tools/rollup-plugins/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/lucide.yml

@@ -11,6 +11,9 @@ on:
       - tools/rollup-plugins/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest