From 821cb1d5644c97eb26ff5a4479b2b39a41b19c3e Mon Sep 17 00:00:00 2001 From: Pierre Schmitz Date: Fri, 21 Aug 2026 13:00:35 +0200 Subject: [PATCH] Limit workflow token permissions --- .github/workflows/ci.yml | 3 +++ .github/workflows/update-go.yml | 3 +++ .github/workflows/update-pnpm.yml | 3 +++ 3 files changed, 9 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 66b57543..747d32c9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -5,6 +5,9 @@ on: pull_request: workflow_dispatch: +permissions: + contents: read + jobs: lint: runs-on: ubuntu-latest diff --git a/.github/workflows/update-go.yml b/.github/workflows/update-go.yml index acef477b..752cdc82 100644 --- a/.github/workflows/update-go.yml +++ b/.github/workflows/update-go.yml @@ -5,6 +5,9 @@ on: - cron: "0 2 * * 1" workflow_dispatch: +permissions: + contents: read + jobs: update: runs-on: ubuntu-latest diff --git a/.github/workflows/update-pnpm.yml b/.github/workflows/update-pnpm.yml index 1355e6f9..4b325a3d 100644 --- a/.github/workflows/update-pnpm.yml +++ b/.github/workflows/update-pnpm.yml @@ -5,6 +5,9 @@ on: - cron: "0 2 1 * *" workflow_dispatch: +permissions: + contents: read + jobs: update: runs-on: ubuntu-latest