ci permissions

Author: ChristianBeilschmidt

.github/workflows/ci.yml

@@ -1,33 +1,36 @@
 name: CI
 
 on:
-    push:
-        branches:
-            - main
-    pull_request:
-        branches:
-            - main
-    workflow_dispatch:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  workflow_dispatch:
 
 jobs:
-    build:
-        runs-on: ubuntu-latest
+  build:
+    runs-on: ubuntu-latest
 
-        steps:
-            - name: Checkout code
-              uses: actions/checkout@v6
+    permissions:
+      contents: read
 
-            - name: Set up Rust
-              uses: actions-rust-lang/setup-rust-toolchain@v1
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
 
-            - name: Run formatter check
-              run: cargo fmt -- --check
+      - name: Set up Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1
 
-            - name: Run linter
-              run: cargo clippy --all-targets --all-features
+      - name: Run formatter check
+        run: cargo fmt -- --check
 
-            - name: Build Rust project
-              run: cargo build --release
+      - name: Run linter
+        run: cargo clippy --all-targets --all-features
 
-            - name: Run tests
-              run: cargo test --release
+      - name: Build Rust project
+        run: cargo build --release
+
+      - name: Run tests
+        run: cargo test --release

.github/workflows/daily.yml

@@ -10,6 +10,9 @@ jobs:
   run-pending-reviews:
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6

.github/workflows/weekly.yml

@@ -9,6 +9,9 @@ jobs:
   run-inactive-cards:
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6