Merge branch 'main' into km/beeep/safe-password-protected-key-envelope

Author: quexten

.github/workflows/build-android.yml

@@ -23,6 +23,9 @@ jobs:
           - target: armv7-linux-androideabi
           - target: x86_64-linux-android
           - target: i686-linux-android
+    permissions:
+      contents: read
+
     steps:
       - name: Checkout repo
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -56,6 +59,10 @@ jobs:
     name: Combine
     runs-on: ubuntu-24.04
     needs: build
+    permissions:
+      contents: read
+      packages: write
+
     steps:
       - name: Checkout repo (PR)
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

.github/workflows/check-powerset.yml

@@ -6,6 +6,9 @@ on:
 env:
   CARGO_TERM_COLOR: always
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Building for ${{ matrix.os }}

.github/workflows/cloc.yml

@@ -6,6 +6,9 @@ on:
     branches: ["main"]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   cloc:
     name: CLOC

.github/workflows/direct-minimal-versions.yml

@@ -13,6 +13,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 jobs:
   direct-minimal-versions:
     name: Check dependencies minimal versions for - ${{ matrix.settings.os }} - ${{ matrix.settings.target }}

.github/workflows/enforce-labels.yml

@@ -4,6 +4,11 @@ on:
   workflow_call:
   pull_request:
     types: [labeled, unlabeled, opened, edited, synchronize]
+
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   enforce-label:
     name: EnforceLabel

.github/workflows/memory-testing.yml

@@ -14,6 +14,9 @@ on:
       - "rc"
       - "hotfix-rc"
 
+permissions:
+  contents: read
+
 jobs:
   memory-test:
     name: Testing

.github/workflows/minimum-rust-version.yml

@@ -13,6 +13,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 jobs:
   msrv:
     name: Check MSRV for - ${{ matrix.settings.os }} - ${{ matrix.settings.target }}

.github/workflows/release-rust-crates.yml

@@ -17,6 +17,8 @@ jobs:
   setup:
     name: Setup
     runs-on: ubuntu-24.04
+    permissions:
+      contents: write
     outputs:
       release-version: ${{ steps.version.outputs.version }}
     steps:

.github/workflows/rust-test.yml

@@ -10,6 +10,9 @@ on:
 env:
   CARGO_TERM_COLOR: always
 
+permissions:
+  contents: read
+
 jobs:
   ci-pass:
     name: Check if tests passed