chore(ci): set explicit least-privilege workflow permissions (#14809)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b257499dfc28a8241bb99c00f2783b38bc2dabe1..54aa0ef0a7873e6bd9c327b608629790fbde971e 100644 (file)
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,6 +10,9 @@ on:
       - main
       - minor
 
+permissions:
+  contents: read
+
 jobs:
   test:
     if: ${{ ! startsWith(github.event.head_commit.message, 'release:') && (github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository) }}

diff --git a/.github/workflows/ecosystem-ci-trigger.yml b/.github/workflows/ecosystem-ci-trigger.yml
index 9af1268f6ec9fecf28fbe507239a513f72c64664..75907f1e37155752912e4e6ad89ea8216db339a5 100644 (file)
--- a/.github/workflows/ecosystem-ci-trigger.yml
+++ b/.github/workflows/ecosystem-ci-trigger.yml
@@ -4,6 +4,11 @@ on:
   issue_comment:
     types: [created]
 
+permissions:
+  contents: read
+  issues: write
+  pull-requests: read
+
 jobs:
   trigger:
     runs-on: ubuntu-latest