ci: limit workflow tokens to repository reads (#866)

2026-09-23 22:03:07 +05:30
parent 51edc41546
commit 2e72fd4ded
3 changed files with 9 additions and 0 deletions
@@ -7,6 +7,9 @@ on:
    tags: ['v*']
  workflow_dispatch:

+permissions:
+  contents: read
+
 concurrency:
  group: codeberg-mirror
  cancel-in-progress: true
@@ -27,6 +27,9 @@ on:
      - '.github/workflows/distro-test-matrix.yml'
  workflow_dispatch:

+permissions:
+  contents: read
+
 # Six containers a run, on a filter that any shell script matches: a second
 # push should not leave the first one's matrix running to completion.
 concurrency:
@@ -28,6 +28,9 @@ on:
      - '.github/workflows/flatpak.yml'
  workflow_dispatch:

+permissions:
+  contents: read
+
 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true