From d7eb45588bb32157255eebd7a27d5e7e4727d298 Mon Sep 17 00:00:00 2001
From: Frazer Smith <frazer.dev@icloud.com>
Date: Mon, 31 Mar 2025 15:28:39 +0100
Subject: [PATCH] ci: set workflow permissions to read-only by default

---
 .github/workflows/release.yml                  | 3 +++
 .github/workflows/validate-workflows-files.yml | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ee0c893..cb4cd92 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -10,6 +10,9 @@ on:
   pull_request:
     types: [closed]
 
+permissions:
+  contents: read
+
 jobs:
   release:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/validate-workflows-files.yml b/.github/workflows/validate-workflows-files.yml
index 5b3f0ce..658b056 100644
--- a/.github/workflows/validate-workflows-files.yml
+++ b/.github/workflows/validate-workflows-files.yml
@@ -9,6 +9,9 @@ on:
     paths:
       - '.github/workflows/*.yml'
 
+permissions:
+  contents: read
+
 jobs:
   validate:
     runs-on: ubuntu-latest