David Barragán Merino 7f95439bc2 👷 Declare least-privilege workflow permissions ...

Add an explicit permissions block to every workflow that relied on the
repository default. Entry points that only call reusable workflows get
permissions: {} and grant each call what the called workflow needs:
contents: read for the bundle and docker builds, contents: write for the
release, nothing for the admin-console dispatch (it uses its own token).
Workflows that check out code get contents: read; the commit checker
also gets pull-requests: read to list the PR commits.

Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>

2026-10-02 09:50:58 +02:00

..

auto-label.yml

👷 Declare least-privilege workflow permissions

2026-10-02 09:50:58 +02:00

build-adhoc.yml

👷 Declare least-privilege workflow permissions

2026-10-02 09:50:58 +02:00

build-bundle.yml

👷 Declare least-privilege workflow permissions

2026-10-02 09:50:58 +02:00

build-develop.yml

👷 Declare least-privilege workflow permissions

2026-10-02 09:50:58 +02:00

build-docker-admin-console.yml

👷 Declare least-privilege workflow permissions

2026-10-02 09:50:58 +02:00

build-docker-devenv.yml

👷 Declare least-privilege workflow permissions

2026-10-02 09:50:58 +02:00

build-docker.yml

👷 Declare least-privilege workflow permissions

2026-10-02 09:50:58 +02:00

build-staging.yml

👷 Declare least-privilege workflow permissions

2026-10-02 09:50:58 +02:00

build-tag.yml

👷 Declare least-privilege workflow permissions

2026-10-02 09:50:58 +02:00

build-tmp-tokens.yml

👷 Declare least-privilege workflow permissions

2026-10-02 09:50:58 +02:00

commit-checker.yml

👷 Declare least-privilege workflow permissions

2026-10-02 09:50:58 +02:00

lint-workflows.yml

👷 Add actionlint and zizmor checks for workflows

2026-09-30 10:31:02 +02:00

plugins-deploy-api-doc.yml

👷 Disable checkout credential persistence

2026-09-30 17:01:58 +02:00

plugins-deploy-package.yml

👷 Pass explicit secrets to reusable workflows

2026-09-30 17:01:58 +02:00

plugins-deploy-packages.yml

👷 Declare least-privilege workflow permissions

2026-10-02 09:50:58 +02:00

plugins-deploy-styles-doc.yml

👷 Disable checkout credential persistence

2026-09-30 17:01:58 +02:00

release.yml

👷 Pass explicit secrets to reusable workflows

2026-09-30 17:01:58 +02:00

tests-backend.yml

👷 Declare least-privilege workflow permissions

2026-10-02 09:50:58 +02:00

tests-common.yml

👷 Declare least-privilege workflow permissions

2026-10-02 09:50:58 +02:00

tests-e2e.yml

👷 Declare least-privilege workflow permissions

2026-10-02 09:50:58 +02:00

tests-exporter.yml

👷 Declare least-privilege workflow permissions

2026-10-02 09:50:58 +02:00

tests-frontend.yml

👷 Declare least-privilege workflow permissions

2026-10-02 09:50:58 +02:00

tests-library.yml

👷 Declare least-privilege workflow permissions

2026-10-02 09:50:58 +02:00

tests-mcp.yml

👷 Declare least-privilege workflow permissions

2026-10-02 09:50:58 +02:00

tests-plugins.yml

👷 Declare least-privilege workflow permissions

2026-10-02 09:50:58 +02:00

tests-wasm.yml

👷 Declare least-privilege workflow permissions

2026-10-02 09:50:58 +02:00