From ced5ef6f0c97f42db8805f0c51a3a2ed8f1b3c2a Mon Sep 17 00:00:00 2001
From: Oleg Shparber <oleg@zealdocs.org>
Date: Sun, 12 Apr 2026 14:59:59 +0300
Subject: [PATCH] ci(github): harden workflow permissions

---
 .github/workflows/analyze-codeql.yaml  |  4 +++-
 .github/workflows/check-lint.yaml      |  1 +
 .github/workflows/check-scorecard.yaml |  1 -
 .github/workflows/lock.yaml            |  7 ++++---
 .github/workflows/release.yaml         | 11 +++++++++--
 5 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/analyze-codeql.yaml b/.github/workflows/analyze-codeql.yaml
index 22350bf9..e64bf8d7 100644
--- a/.github/workflows/analyze-codeql.yaml
+++ b/.github/workflows/analyze-codeql.yaml
@@ -11,7 +11,6 @@ on:
 
 permissions:
   contents: read
-  security-events: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -21,6 +20,9 @@ jobs:
   analyze-codeql:
     name: Analyze
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      security-events: write
 
     steps:
     - name: Checkout Repository
diff --git a/.github/workflows/check-lint.yaml b/.github/workflows/check-lint.yaml
index da2ff6ce..85f9813f 100644
--- a/.github/workflows/check-lint.yaml
+++ b/.github/workflows/check-lint.yaml
@@ -19,6 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+
     steps:
       - name: Checkout
         uses: actions/checkout@v6
diff --git a/.github/workflows/check-scorecard.yaml b/.github/workflows/check-scorecard.yaml
index a80445d9..1b22cd39 100644
--- a/.github/workflows/check-scorecard.yaml
+++ b/.github/workflows/check-scorecard.yaml
@@ -15,7 +15,6 @@ jobs:
     name: Analyze
     if: github.repository == 'zealdocs/zeal'
     runs-on: ubuntu-24.04
-
     permissions:
       security-events: write
       id-token: write
diff --git a/.github/workflows/lock.yaml b/.github/workflows/lock.yaml
index 46ea0e42..7e7c76da 100644
--- a/.github/workflows/lock.yaml
+++ b/.github/workflows/lock.yaml
@@ -5,9 +5,7 @@ on:
     - cron: "0 0 * * *"
   workflow_dispatch:
 
-permissions:
-  issues: write
-  pull-requests: write
+permissions: {}
 
 concurrency:
   group: lock
@@ -17,6 +15,9 @@ jobs:
     name: Lock Old Issues
     if: github.repository == 'zealdocs/zeal'
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
 
     steps:
       - uses: dessant/lock-threads@v6
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index cfc5ac47..4333a561 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -5,8 +5,7 @@ on:
     tags:
       - "v*.*.*"
 
-permissions:
-  contents: write
+permissions: {}
 
 concurrency:
   group: ${{ github.workflow }}
@@ -16,6 +15,9 @@ jobs:
   build-windows:
     name: ${{ matrix.config.name }}
     runs-on: ${{ matrix.config.os }}
+    permissions:
+      contents: write
+
     strategy:
       fail-fast: false
       matrix:
@@ -98,6 +100,8 @@ jobs:
   build-appimage:
     name: AppImage
     runs-on: ubuntu-24.04
+    permissions:
+      contents: write
 
     steps:
       - name: Checkout
@@ -174,6 +178,9 @@ jobs:
   build-ubuntu:
     name: ${{ matrix.config.name }}
     runs-on: ${{ matrix.config.os }}
+    permissions:
+      contents: write
+
     strategy:
       fail-fast: false
       matrix: