From e232fc66e62a3a1d918b4bb97ed3135c2dee37c8 Mon Sep 17 00:00:00 2001
From: andreadimaio <dmaio.andrea@gmail.com>
Date: Fri, 2 Oct 2026 11:06:36 +0200
Subject: [PATCH] Add explicit permissions to GitHub Actions workflows

---
 .github/workflows/deploy-docs.yml  | 1 +
 .github/workflows/post-release.yml | 3 +++
 .github/workflows/pre-release.yml  | 3 +++
 .github/workflows/release.yml      | 3 +++
 .github/workflows/test.yml         | 3 +++
 5 files changed, 13 insertions(+)

diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
index 7b3e009c..cab711f8 100644
--- a/.github/workflows/deploy-docs.yml
+++ b/.github/workflows/deploy-docs.yml
@@ -7,6 +7,7 @@ on:
       - "*"
 
 permissions:
+  contents: read
   pages: write
   id-token: write
 
diff --git a/.github/workflows/post-release.yml b/.github/workflows/post-release.yml
index f03a1a0a..63991ed7 100644
--- a/.github/workflows/post-release.yml
+++ b/.github/workflows/post-release.yml
@@ -7,6 +7,9 @@ on:
     types:
       - completed
 
+permissions:
+  contents: read
+
 jobs:
   revert:
     if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
diff --git a/.github/workflows/pre-release.yml b/.github/workflows/pre-release.yml
index 6bb02938..2076da2b 100644
--- a/.github/workflows/pre-release.yml
+++ b/.github/workflows/pre-release.yml
@@ -7,6 +7,9 @@ on:
     paths:
       - ".github/project.yml"
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{github.workflow}}-${{github.ref}}
   cancel-in-progress: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6a6e1b64..dbdd43e7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -6,6 +6,9 @@ on:
     tags:
       - "[0-9]+.[0-9]+.[0-9]+"
 
+permissions:
+  contents: read
+
 jobs:
   release:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index c91ed567..41603fbb 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -11,6 +11,9 @@ on:
       - "*.txt"
       - ".all-contributorsrc"
 
+permissions:
+  contents: read
+
 env:
   JAVA_MIN: "17"
   JAVA_MAX: "25"