From 2e72fd4ded19d2bf2ff1edd20d38b02d94147ef2 Mon Sep 17 00:00:00 2001
From: Kanishk Pachauri <itskanishkp.py@gmail.com>
Date: Wed, 23 Sep 2026 22:03:07 +0530
Subject: [PATCH] ci: limit workflow tokens to repository reads (#866)

---
 .github/workflows/codeberg-mirror.yml    | 3 +++
 .github/workflows/distro-test-matrix.yml | 3 +++
 .github/workflows/flatpak.yml            | 3 +++
 3 files changed, 9 insertions(+)

diff --git a/.github/workflows/codeberg-mirror.yml b/.github/workflows/codeberg-mirror.yml
index 82eba21..500c260 100644
--- a/.github/workflows/codeberg-mirror.yml
+++ b/.github/workflows/codeberg-mirror.yml
@@ -7,6 +7,9 @@ on:
     tags: ['v*']
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: codeberg-mirror
   cancel-in-progress: true
diff --git a/.github/workflows/distro-test-matrix.yml b/.github/workflows/distro-test-matrix.yml
index dc2cede..0ef5b2a 100644
--- a/.github/workflows/distro-test-matrix.yml
+++ b/.github/workflows/distro-test-matrix.yml
@@ -27,6 +27,9 @@ on:
       - '.github/workflows/distro-test-matrix.yml'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 # Six containers a run, on a filter that any shell script matches: a second
 # push should not leave the first one's matrix running to completion.
 concurrency:
diff --git a/.github/workflows/flatpak.yml b/.github/workflows/flatpak.yml
index 084e166..188ffa3 100644
--- a/.github/workflows/flatpak.yml
+++ b/.github/workflows/flatpak.yml
@@ -28,6 +28,9 @@ on:
       - '.github/workflows/flatpak.yml'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true