Reduce permissions for Github actions by reducing to minimal permissions (#2961)

michael-kerscher · web-flow · commit a5e68972c2c8 · 2025-10-29T14:37:13.000+01:00
This is increasing the security of this repository. A standard GITHUB_TOKEN currently has these permissions. GITHUB_TOKEN Permissions Contents: read Metadata: read Packages: read Setting only `contents: read` permission has the effect of removing Packages permission. Metadata is added automatically. fixes #2958
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -1,4 +1,6 @@
 name: Test
+permissions:
+  contents: read
 
 on:
   pull_request:
diff --git a/.github/workflows/check-msgid-changes.yml b/.github/workflows/check-msgid-changes.yml
@@ -1,4 +1,6 @@
 name: Prevent unintended msgid changes
+permissions:
+  contents: read
 
 on:
   pull_request:
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -1,4 +1,6 @@
 name: Lint
+permissions:
+  contents: read
 
 on:
   pull_request:
