From 858f2ce9e502e44303fdc87ad020283590d56bec Mon Sep 17 00:00:00 2001
From: Steven Bal <steven@maykinmedia.nl>
Date: Tue, 24 Mar 2026 10:04:07 +0100
Subject: [PATCH] :construction_worker: Add explicit least privilege
 permissions for each workflow

---
 .github/workflows/bin-check.yml    | 4 ++++
 .github/workflows/ci.yml           | 4 ++++
 .github/workflows/code-quality.yml | 4 ++++
 .github/workflows/oaf-check.yml    | 3 +++
 .github/workflows/oas.yml          | 4 ++++
 .github/workflows/quick_start.yml  | 4 ++++
 6 files changed, 23 insertions(+)

diff --git a/.github/workflows/bin-check.yml b/.github/workflows/bin-check.yml
index f87303b6..568e9df9 100644
--- a/.github/workflows/bin-check.yml
+++ b/.github/workflows/bin-check.yml
@@ -8,6 +8,10 @@ on:
   pull_request:
   workflow_dispatch:
 
+# least privilege as default, should be overridden per job if necessary
+permissions:
+  contents: read
+
 jobs:
   dump_data:
     name: Test dump_data.sh
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e48c7457..354b22ca 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,6 +9,10 @@ on:
   pull_request:
   workflow_dispatch:
 
+# least privilege as default, should be overridden per job if necessary
+permissions:
+  contents: read
+
 env:
   IMAGE_NAME: maykinmedia/objecttypes-api
 
diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml
index 5b0a7fa6..eb540197 100644
--- a/.github/workflows/code-quality.yml
+++ b/.github/workflows/code-quality.yml
@@ -7,6 +7,10 @@ on:
   pull_request:
   workflow_dispatch:
 
+# least privilege as default, should be overridden per job if necessary
+permissions:
+  contents: read
+
 jobs:
   open-api-workflow-code-quality:
     uses: maykinmedia/open-api-workflows/.github/workflows/code-quality.yml@v6
diff --git a/.github/workflows/oaf-check.yml b/.github/workflows/oaf-check.yml
index d0ad80b7..4c53e6d6 100644
--- a/.github/workflows/oaf-check.yml
+++ b/.github/workflows/oaf-check.yml
@@ -10,6 +10,9 @@ on:
   schedule:
     - cron: '0 7 * * 1'
 
+# least privilege as default, should be overridden per job if necessary
+permissions:
+  contents: read
 
 jobs:
   open-api-workflow-check-oas:
diff --git a/.github/workflows/oas.yml b/.github/workflows/oas.yml
index fbc83985..293326b8 100644
--- a/.github/workflows/oas.yml
+++ b/.github/workflows/oas.yml
@@ -10,6 +10,10 @@ on:
   pull_request:
   workflow_dispatch:
 
+# least privilege as default, should be overridden per job if necessary
+permissions:
+  contents: read
+
 jobs:
   oas:
     name: Checks
diff --git a/.github/workflows/quick_start.yml b/.github/workflows/quick_start.yml
index d354d09d..0e7e7467 100644
--- a/.github/workflows/quick_start.yml
+++ b/.github/workflows/quick_start.yml
@@ -9,6 +9,10 @@ on:
       - '**'
   workflow_dispatch:
 
+# least privilege as default, should be overridden per job if necessary
+permissions:
+  contents: read
+
 jobs:
   open-api-workflow-quick-start:
     uses: maykinmedia/open-api-workflows/.github/workflows/quick-start.yml@v6