From 1d34247c893a20cc648eae868437e187cebe7dae Mon Sep 17 00:00:00 2001 From: Mridankan Mandal Date: Wed, 22 Jul 2026 09:21:16 +0530 Subject: [PATCH] ci: restrict workflow token permissions Declare the minimum GITHUB_TOKEN access required by each non-release workflow instead of relying on repository or organization defaults. Signed-off-by: Mridankan Mandal --- .github/workflows/changelog.yml | 3 +++ .github/workflows/docs.yml | 3 +++ .github/workflows/ext.yml | 3 +++ .github/workflows/main.yml | 3 +++ 4 files changed, 12 insertions(+) diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml index 89c51fd3..a9cdcc15 100644 --- a/.github/workflows/changelog.yml +++ b/.github/workflows/changelog.yml @@ -4,6 +4,9 @@ on: pull_request: types: [opened, synchronize, reopened, labeled, unlabeled] +permissions: + pull-requests: read + jobs: check: runs-on: ubuntu-latest diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 4302e0a9..b5856b06 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -5,6 +5,9 @@ on: tags: - '*' +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest diff --git a/.github/workflows/ext.yml b/.github/workflows/ext.yml index d43a2b8a..996976e0 100644 --- a/.github/workflows/ext.yml +++ b/.github/workflows/ext.yml @@ -3,6 +3,9 @@ name: Ext Tests on: pull_request: +permissions: + contents: read + jobs: appraise: runs-on: ubuntu-latest diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 15891f19..6e3d9f87 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -7,6 +7,9 @@ on: pull_request: +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest