Sets minimal set of workflow permissions

Author: epaganon

.github/workflows/build-test-publish.yml

@@ -1,4 +1,4 @@
-# Copyright 2022-2025 The MathWorks, Inc.
+# Copyright 2022-2026 The MathWorks, Inc.
 
 name: Build, Test and Publish the Dockerfile
 
@@ -7,7 +7,7 @@ name: Build, Test and Publish the Dockerfile
 on:
   workflow_dispatch:
   push:
-    # Trigger the workflow is the Dockerfile or any file under tests/ is modified
+    # Trigger the workflow when the Dockerfile or any file under tests/ is modified
     paths:
       - "Dockerfile"
       - "tests/*"
@@ -25,6 +25,11 @@ env:
 jobs:
   build-test-push-image:
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      packages: write
+
     strategy:
       fail-fast: false
       matrix:
@@ -82,9 +87,9 @@ jobs:
         run: echo '${{ secrets.MATLAB_LICENSE_FILE }}' > ${{ env.LICENSE_FILE_PATH }}
 
       - name: Test container
+        working-directory: tests
         env:
           IMAGE_NAME: ${{ env.IMAGE_BASE_NAME }}:${{ matrix.matlab-release }}
-        working-directory: tests
         run: python -m unittest -v
 
       - name: Push the image to ghcr.io

.github/workflows/from-matlab-docker-build-test.yml

@@ -1,4 +1,4 @@
-# Copyright 2023-2025 The MathWorks, Inc.
+# Copyright 2023-2026 The MathWorks, Inc.
 
 name: Build and Test the "Building on MATLAB Docker Image" Dockerfile
 
@@ -26,6 +26,10 @@ env:
 jobs:
   build-test-image:
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
     strategy:
       fail-fast: false
       matrix:

.github/workflows/matlab-container-offline-install-build-test.yml

@@ -1,4 +1,4 @@
-# Copyright 2024-2025 The MathWorks, Inc.
+# Copyright 2024-2026 The MathWorks, Inc.
 
 name: Build and Test the "MATLAB Container Offline Install" Dockerfiles
 
@@ -29,6 +29,10 @@ env:
 jobs:
   build-test-image:
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
     strategy:
       fail-fast: false
       matrix:

.github/workflows/matlab-installer-build-test.yml

@@ -1,4 +1,4 @@
-# Copyright 2023-2025 The MathWorks, Inc.
+# Copyright 2023-2026 The MathWorks, Inc.
 
 name: Build and Test the "MATLAB installer" Dockerfile
 
@@ -25,6 +25,10 @@ env:
 jobs:
   build-test-image:
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
     defaults:
       run:
         shell: bash
@@ -47,7 +51,7 @@ jobs:
     steps:
       - name: Checkout repo
         uses: actions/checkout@v4
-    
+
       - name: Cleanup runner
         uses: ./.github/actions/cleanup-runner
 

.github/workflows/non-interactive-build-test.yml

@@ -1,6 +1,6 @@
-# Copyright 2024-2025 The MathWorks, Inc.
+# Copyright 2024-2026 The MathWorks, Inc.
 
-name: Build and Test the "Non-Interactive" Dockerfile
+name: Build, Test and Publish the "Non-Interactive" Dockerfile
 
 # Trigger this workflow either manually or when a new change is pushed to the
 # repo (except .md files)
@@ -23,8 +23,13 @@ env:
   ALT_PATH: alternates/non-interactive
 
 jobs:
-  build-test-image:
+  build-test-push-image:
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      packages: write
+
     strategy:
       fail-fast: false
       matrix:

.github/workflows/windows-container-build-test-publish.yml

@@ -1,4 +1,4 @@
-# Copyright 2025 The MathWorks, Inc.
+# Copyright 2025-2026 The MathWorks, Inc.
 
 name: Build, Test and Publish the Windows Dockerfile
 
@@ -24,6 +24,11 @@ env:
 jobs:
   windows-container-build-test-push-image:
     runs-on: windows-2022
+
+    permissions:
+      contents: read
+      packages: write
+
     strategy:
       fail-fast: false
       matrix: