From 84bccdd333d91e8cb7dbfabc6c5b20753d88dc62 Mon Sep 17 00:00:00 2001
From: correctmost <134317971+correctmost@users.noreply.github.com>
Date: Sun, 23 Aug 2026 13:33:28 -0400
Subject: [PATCH] Unset default permissions for testing and linting workflows

This commit addresses some excessive-permissions warnings from
zizmor.
---
 .github/workflows/bandit.yaml            | 1 +
 .github/workflows/flake8.yaml            | 1 +
 .github/workflows/mypy.yaml              | 1 +
 .github/workflows/pylint.yaml            | 1 +
 .github/workflows/pytest.yaml            | 1 +
 .github/workflows/ruff-format.yaml       | 1 +
 .github/workflows/ruff-lint.yaml         | 1 +
 .github/workflows/translation-check.yaml | 1 +
 8 files changed, 8 insertions(+)

diff --git a/.github/workflows/bandit.yaml b/.github/workflows/bandit.yaml
index 1b71ab6971..4ff21cebb0 100644
--- a/.github/workflows/bandit.yaml
+++ b/.github/workflows/bandit.yaml
@@ -1,5 +1,6 @@
 on: [ push, pull_request ]
 name: Bandit security checkup
+permissions: {}
 jobs:
     bandit:
         runs-on: ubuntu-latest
diff --git a/.github/workflows/flake8.yaml b/.github/workflows/flake8.yaml
index 80c086a0b0..51017edf59 100644
--- a/.github/workflows/flake8.yaml
+++ b/.github/workflows/flake8.yaml
@@ -1,5 +1,6 @@
 on: [ push, pull_request ]
 name: flake8 linting
+permissions: {}
 jobs:
     flake8:
         runs-on: ubuntu-latest
diff --git a/.github/workflows/mypy.yaml b/.github/workflows/mypy.yaml
index aab849cb1f..5febcd63e7 100644
--- a/.github/workflows/mypy.yaml
+++ b/.github/workflows/mypy.yaml
@@ -1,5 +1,6 @@
 on: [ push, pull_request ]
 name: mypy type checking
+permissions: {}
 jobs:
     mypy:
         runs-on: ubuntu-latest
diff --git a/.github/workflows/pylint.yaml b/.github/workflows/pylint.yaml
index e3480de7fa..c13acabb41 100644
--- a/.github/workflows/pylint.yaml
+++ b/.github/workflows/pylint.yaml
@@ -1,5 +1,6 @@
 on: [ push, pull_request ]
 name: Pylint linting
+permissions: {}
 jobs:
     pylint:
         runs-on: ubuntu-latest
diff --git a/.github/workflows/pytest.yaml b/.github/workflows/pytest.yaml
index 6f914de0fb..7fe3c7b70b 100644
--- a/.github/workflows/pytest.yaml
+++ b/.github/workflows/pytest.yaml
@@ -1,5 +1,6 @@
 on: [ push, pull_request ]
 name: pytest test validation
+permissions: {}
 jobs:
     pytest:
         runs-on: ubuntu-latest
diff --git a/.github/workflows/ruff-format.yaml b/.github/workflows/ruff-format.yaml
index 0452776380..318016b084 100644
--- a/.github/workflows/ruff-format.yaml
+++ b/.github/workflows/ruff-format.yaml
@@ -1,5 +1,6 @@
 on: [ push, pull_request ]
 name: ruff check formatting
+permissions: {}
 jobs:
   ruff_format_check:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/ruff-lint.yaml b/.github/workflows/ruff-lint.yaml
index 12a7f88d5b..1506058d7e 100644
--- a/.github/workflows/ruff-lint.yaml
+++ b/.github/workflows/ruff-lint.yaml
@@ -1,5 +1,6 @@
 on: [ push, pull_request ]
 name: ruff check linting
+permissions: {}
 jobs:
     ruff:
         runs-on: ubuntu-latest
diff --git a/.github/workflows/translation-check.yaml b/.github/workflows/translation-check.yaml
index 40cce6ee53..3b7368ea75 100644
--- a/.github/workflows/translation-check.yaml
+++ b/.github/workflows/translation-check.yaml
@@ -10,6 +10,7 @@ on:
             - 'archinstall/**/*.py'
             - 'archinstall/locales/**'
             - '.github/workflows/translation-check.yaml'
+permissions: {}
 jobs:
     translations:
         name: Validate translations