From 13a79244ac54352bd4539e1766cc10090395379b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 6 Feb 2026 22:07:25 +0000
Subject: [PATCH] security: Add explicit GITHUB_TOKEN permissions to all
 workflows

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
---
 .github/workflows/lint.yml     | 3 +++
 .github/workflows/security.yml | 5 +++++
 .github/workflows/test.yml     | 4 ++++
 3 files changed, 12 insertions(+)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index e818d6f..54c7747 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -10,6 +10,9 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     
+    permissions:
+      contents: read
+    
     steps:
     - uses: actions/checkout@v4
     
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 3dd1dec..c2cd1b2 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -12,6 +12,11 @@ jobs:
   security:
     runs-on: ubuntu-latest
     
+    permissions:
+      contents: read
+      security-events: write  # For CodeQL
+      actions: read
+    
     steps:
     - uses: actions/checkout@v4
     
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 16c492f..b02acb4 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -10,6 +10,10 @@ jobs:
   test:
     runs-on: ubuntu-latest
     
+    permissions:
+      contents: read
+      pull-requests: write  # For coverage comments
+    
     services:
       postgres:
         image: postgres:15