Add workflow permissions

MichaelRFairhurst · MichaelRFairhurst · commit dc56e9d93c8e · 2025-12-08T21:16:53.000-08:00
diff --git a/.github/workflows/code-scanning-pack-gen.yml b/.github/workflows/code-scanning-pack-gen.yml
@@ -1,4 +1,6 @@
 name: Code Scanning Query Pack Generation
+permissions:
+  contents: read
 
 on:
   merge_group:
diff --git a/.github/workflows/codeql_unit_tests.yml b/.github/workflows/codeql_unit_tests.yml
@@ -1,4 +1,6 @@
 name: CodeQL Unit Testing
+permissions:
+  contents: read
 
 on:
   merge_group:
diff --git a/.github/workflows/dispatch-matrix-test-on-comment.yml b/.github/workflows/dispatch-matrix-test-on-comment.yml
@@ -1,4 +1,8 @@
 name: 🤖 Run Matrix Check (On Comment)
+permissions:
+  contents: read
+  actions: write
+  pull-requests: write
 
 on:
   issue_comment:
diff --git a/.github/workflows/dispatch-release-performance-check.yml b/.github/workflows/dispatch-release-performance-check.yml
@@ -1,4 +1,8 @@
 name: 🏁 Run Release Performance Check
+permissions:
+  contents: read
+  actions: write
+  pull-requests: write
 
 on:
   issue_comment:
diff --git a/.github/workflows/extra-rule-validation.yml b/.github/workflows/extra-rule-validation.yml
@@ -1,4 +1,6 @@
 name: ⚙️ Extra Rule Validation
+permissions:
+  contents: read
 
 on:
   merge_group:
diff --git a/.github/workflows/finalize-release.yml b/.github/workflows/finalize-release.yml
@@ -1,4 +1,9 @@
 name: Finalize Release
+permissions: 
+  contents: write
+  pull-requests: write
+  actions: write
+
 on:
   pull_request:
     types:
diff --git a/.github/workflows/generate-html-docs.yml b/.github/workflows/generate-html-docs.yml
@@ -1,4 +1,6 @@
 name: Generate HTML documentation
+permissions:
+  contents: read
 
 on:
   merge_group:
diff --git a/.github/workflows/standard_library_upgrade_tests.yml b/.github/workflows/standard_library_upgrade_tests.yml
@@ -1,4 +1,6 @@
 name: CodeQL Standard Library Upgrade tests
+permission: 
+  contents: read
 
 # Run this workflow every time the "supported_codeql_configs.json" file is changed
 on:
diff --git a/.github/workflows/tooling-unit-tests.yml b/.github/workflows/tooling-unit-tests.yml
@@ -1,4 +1,6 @@
 name: 🧰 Tooling unit tests
+permissions:
+  contents: read
 
 on:
   merge_group:
diff --git a/.github/workflows/update-check-run.yml b/.github/workflows/update-check-run.yml
@@ -1,4 +1,6 @@
 name: Update check run
+permissions:
+  contents: read
 
 on:
   workflow_dispatch:
diff --git a/.github/workflows/update-release.yml b/.github/workflows/update-release.yml
@@ -1,4 +1,8 @@
 name: Update Release
+permissions:
+  contents: write
+  pull-requests: write
+  actions: write
 
 on:
   workflow_dispatch:
diff --git a/.github/workflows/upgrade_codeql_dependencies.yml b/.github/workflows/upgrade_codeql_dependencies.yml
@@ -1,4 +1,7 @@
 name: Upgrade supported CodeQL configuration
+permissions:
+  contents: write
+  pull-requests: write
 
 on:
   workflow_dispatch:
diff --git a/.github/workflows/validate-package-files.yml b/.github/workflows/validate-package-files.yml
@@ -1,4 +1,6 @@
 name: Validate Package Files
+permissions:
+  contents: read
 on:
   merge_group:
     types: [checks_requested]
diff --git a/.github/workflows/validate-query-formatting.yml b/.github/workflows/validate-query-formatting.yml
@@ -1,4 +1,6 @@
 name: "Validate Query Formatting"
+permissions:
+  contents: read
 on:
   merge_group:
     types: [checks_requested]
diff --git a/.github/workflows/validate-query-help.yml b/.github/workflows/validate-query-help.yml
@@ -1,4 +1,6 @@
 name: Validate Query Help Files
+permissions:
+  contents: read
 on:
   merge_group:
     types: [checks_requested]
diff --git a/.github/workflows/validate-query-test-case-formatting.yml b/.github/workflows/validate-query-test-case-formatting.yml
@@ -1,4 +1,6 @@
 name: Validate Query Test Case Formatting
+permissions:
+  contents: read
 on:
   merge_group:
     types: [checks_requested]
diff --git a/.github/workflows/validate-release.yml b/.github/workflows/validate-release.yml
@@ -1,4 +1,9 @@
 name: Validate release
+permissions:
+  contents: read
+  actions: write
+  checks: write
+  pull-requests: write
 
 on:
   pull_request:
diff --git a/.github/workflows/verify-standard-library-dependencies.yml b/.github/workflows/verify-standard-library-dependencies.yml
@@ -1,4 +1,6 @@
 name: Verify Standard Library Dependencies
+permissions:
+  contents: read
 
 # Run this workflow every time the "supported_codeql_configs.json" file or a "qlpack.yml" file is changed
 on:
