security: Add explicit GITHUB_TOKEN permissions to all workflows

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
2026-02-06 22:07:25 +00:00
parent da4d501acb
commit 13a79244ac
3 changed files with 12 additions and 0 deletions
@@ -10,6 +10,9 @@ jobs:
  lint:
    runs-on: ubuntu-latest
    
+    permissions:
+      contents: read
+    
    steps:
    - uses: actions/checkout@v4
    
@@ -12,6 +12,11 @@ jobs:
  security:
    runs-on: ubuntu-latest
    
+    permissions:
+      contents: read
+      security-events: write  # For CodeQL
+      actions: read
+    
    steps:
    - uses: actions/checkout@v4
    
@@ -10,6 +10,10 @@ jobs:
  test:
    runs-on: ubuntu-latest
    
+    permissions:
+      contents: read
+      pull-requests: write  # For coverage comments
+    
    services:
      postgres:
        image: postgres:15