From bb165bfbc75aea27cd35e96ed4fa459eb9d05390 Mon Sep 17 00:00:00 2001
From: Oleg Shparber <oleg@zealdocs.org>
Date: Sun, 29 Mar 2026 03:14:15 +0300
Subject: [PATCH] ci(github): add explicit permissions to workflows (#1788)

---
 .github/workflows/analyze-codeql.yaml   | 7 ++++---
 .github/workflows/analyze-coverity.yaml | 3 +++
 .github/workflows/build-check.yaml      | 3 +++
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/analyze-codeql.yaml b/.github/workflows/analyze-codeql.yaml
index 93a99256..11edc234 100644
--- a/.github/workflows/analyze-codeql.yaml
+++ b/.github/workflows/analyze-codeql.yaml
@@ -9,6 +9,10 @@ on:
   schedule:
   - cron: '0 8 * * 6'
 
+permissions:
+  contents: read
+  security-events: write
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -18,9 +22,6 @@ jobs:
     name: Analyze
     runs-on: ubuntu-24.04
 
-    permissions:
-      security-events: write
-
     steps:
     - name: Checkout Repository
       uses: actions/checkout@v6
diff --git a/.github/workflows/analyze-coverity.yaml b/.github/workflows/analyze-coverity.yaml
index e98c4410..b5107615 100644
--- a/.github/workflows/analyze-coverity.yaml
+++ b/.github/workflows/analyze-coverity.yaml
@@ -4,6 +4,9 @@ on:
   push:
     branches: [main]
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
diff --git a/.github/workflows/build-check.yaml b/.github/workflows/build-check.yaml
index 95ea49f4..12e0055c 100644
--- a/.github/workflows/build-check.yaml
+++ b/.github/workflows/build-check.yaml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true