To fix this issue, add a permissions block at the workflow root or job level, specifying the least required privileges. In this workflow, the jobs simply echo environment variables and use curl, so neither requires any write access to the repository. The best practice is to add the following block at the top level (applies to all jobs unless individually overridden):

permissions:
  contents: read

This should be placed just below the name field and prior to on. Alternatively, you could add it within each job, but for conciseness and maintainability, the root-level block is preferred. No new imports or definitions are needed.