From c7d8e62e97bf3b48ed1b5455075066b619b7ae45 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bobo=20B=C3=A4ck=20Engstr=C3=B6m?= <bobo@id8-engineering.io>
Date: Wed, 11 Mar 2026 16:39:11 +0100
Subject: [PATCH] chore(security): fix "Token-Permissions" rule for workflows
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Bobo Bäck Engström <bobo@id8-engineering.io>
---
 .github/workflows/dco.yaml                 |  4 ++++
 .github/workflows/publish-to-pypi.yml      |  5 ++++-
 .github/workflows/publish-to-test-pypi.yml |  4 ++++
 .github/workflows/pyright.yml              | 16 ++++++++++------
 .github/workflows/pytest.yml               |  5 ++++-
 .github/workflows/release-please.yml       | 10 ++++++----
 .github/workflows/ruff.yml                 | 16 ++++++++++------
 7 files changed, 42 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/dco.yaml b/.github/workflows/dco.yaml
index 85c3979..37e1c47 100644
--- a/.github/workflows/dco.yaml
+++ b/.github/workflows/dco.yaml
@@ -5,6 +5,10 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   check:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/publish-to-pypi.yml b/.github/workflows/publish-to-pypi.yml
index a0cecaa..2419d74 100644
--- a/.github/workflows/publish-to-pypi.yml
+++ b/.github/workflows/publish-to-pypi.yml
@@ -5,6 +5,10 @@ on:
     tags:
       - "*"
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   build:
     name: Build distribution
@@ -56,4 +60,3 @@ jobs:
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
           verbose: true
-
diff --git a/.github/workflows/publish-to-test-pypi.yml b/.github/workflows/publish-to-test-pypi.yml
index 5a8b18b..00cdccd 100644
--- a/.github/workflows/publish-to-test-pypi.yml
+++ b/.github/workflows/publish-to-test-pypi.yml
@@ -4,6 +4,10 @@ on:
   push:
     branches: ["main"]
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   build:
     name: Build distribution
diff --git a/.github/workflows/pyright.yml b/.github/workflows/pyright.yml
index 2263841..bda940a 100644
--- a/.github/workflows/pyright.yml
+++ b/.github/workflows/pyright.yml
@@ -1,11 +1,15 @@
 name: pyright
 
-on:
-  pull_request:
-    branches: ["main"]
-
-jobs:
-  type-check:
+on:
+  pull_request:
+    branches: ["main"]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  type-check:
     runs-on: ubuntu-latest
     strategy:
       matrix:
diff --git a/.github/workflows/pytest.yml b/.github/workflows/pytest.yml
index 937a8be..375f15c 100644
--- a/.github/workflows/pytest.yml
+++ b/.github/workflows/pytest.yml
@@ -4,6 +4,10 @@ on:
   pull_request:
     branches: [ "main" ]
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   uv-example:
     name: python
@@ -31,4 +35,3 @@ jobs:
       - name: Run tests
         run: |
           uv run pytest
-
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 4af0650..12cf396 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -6,16 +6,18 @@ on:
       - main
 
 permissions:
-  contents: write
-  issues: write
-  pull-requests: write
+  contents: read
+  pull-requests: read
 
 jobs:
   release-please:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
     steps:
       - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           release-type: python
-
diff --git a/.github/workflows/ruff.yml b/.github/workflows/ruff.yml
index c34eee1..0d0ef01 100644
--- a/.github/workflows/ruff.yml
+++ b/.github/workflows/ruff.yml
@@ -1,11 +1,15 @@
 name: ruff
 
-on:
-  pull_request:
-    branches: [ "main" ]
-
-jobs:
-  lint:
+on:
+  pull_request:
+    branches: [ "main" ]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  lint:
     runs-on: ubuntu-latest
     strategy:
       matrix: