From 4815eae41287a117943522011901e4eaa3e8ca0b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?H=C3=A5vard=20Berland?= <havb@equinor.com>
Date: Wed, 8 Oct 2025 12:28:54 +0200
Subject: [PATCH] Explicitly limit the permissions of workflows to read-only

---
 .github/workflows/actionlint.yml      | 2 ++
 .github/workflows/publish_to_pypi.yml | 2 ++
 .github/workflows/style.yml           | 2 ++
 .github/workflows/testing.yml         | 2 ++
 .github/workflows/typing.yml          | 2 ++
 5 files changed, 10 insertions(+)

diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
index 31c90bfe7..1fe0041fb 100644
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@@ -10,6 +10,8 @@ on:
 jobs:
   actionlint:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
       - name: Download actionlint
diff --git a/.github/workflows/publish_to_pypi.yml b/.github/workflows/publish_to_pypi.yml
index eac429a4c..804b2fc8d 100644
--- a/.github/workflows/publish_to_pypi.yml
+++ b/.github/workflows/publish_to_pypi.yml
@@ -9,6 +9,8 @@ jobs:
   build-n-publish:
     name: Build and publish Python 🐍 distributions 📦 to PyPI
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
         with:
diff --git a/.github/workflows/style.yml b/.github/workflows/style.yml
index 571a2e52a..fa139b8c7 100644
--- a/.github/workflows/style.yml
+++ b/.github/workflows/style.yml
@@ -14,6 +14,8 @@ jobs:
   lint:
     name: Linting through pre-commit
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
       - name: Setup Python
diff --git a/.github/workflows/testing.yml b/.github/workflows/testing.yml
index a93cee739..4b695c8ef 100644
--- a/.github/workflows/testing.yml
+++ b/.github/workflows/testing.yml
@@ -15,6 +15,8 @@ jobs:
   tests:
     name: "Python ${{ matrix.python-version }} on ${{ matrix.os }}"
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/typing.yml b/.github/workflows/typing.yml
index 7178c0a8b..ab9fc7ab8 100644
--- a/.github/workflows/typing.yml
+++ b/.github/workflows/typing.yml
@@ -13,6 +13,8 @@ env:
 jobs:
   type-checking:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     timeout-minutes: 15
     strategy:
       matrix: