From a12bcc2ac6c5b8331429d665740ce5a3f43d5dc1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A1s=20Felleg?= <afelleg@gmail.com>
Date: Thu, 8 Oct 2026 11:21:59 +0200
Subject: [PATCH] build: apply least privilege to workflows
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: András Felleg <afelleg@gmail.com>
---
 .github/workflows/build.yaml   | 9 +++++++++
 .github/workflows/publish.yaml | 6 +++++-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 2f25b119a..5e876c563 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -13,11 +13,15 @@ on:
   workflow_dispatch:
     # Allow workflow to be triggered manually.
 
+permissions: {}
+
 jobs:
   detect-secrets:
     if: "!contains(github.event.head_commit.message, '[skip ci]')"
     name: detect-secrets
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout repository
@@ -41,6 +45,8 @@ jobs:
     name: build-test (java ${{matrix.java-version}})
     needs: detect-secrets
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
         java-version: ['11', '25']
@@ -64,6 +70,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Final Test Results
     needs: [build]
+    permissions: {}
     steps:
       - run: |
           result="${{ needs.build.result }}"
@@ -78,6 +85,8 @@ jobs:
     needs: build
     if: "github.ref_name == 'main' && github.event_name != 'pull_request'"
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout repository
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 76af23655..b08009c45 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -11,11 +11,15 @@ on:
   workflow_dispatch:
     # Allow this workflow to be triggered manually
 
+permissions: {}
+
 jobs:
   publish:
     name: publish-release
     runs-on: ubuntu-latest
- 
+    permissions:
+      contents: read
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4