From bc74db29ad79f92d14f8828bf3b23b652e4320fb Mon Sep 17 00:00:00 2001
From: Henrik Andersson <jan@dhigroup.com>
Date: Wed, 26 Aug 2026 13:55:07 +0200
Subject: [PATCH] Restrict GITHUB_TOKEN permissions in workflows

CodeQL (actions/missing-workflow-permissions) flags workflows without an
explicit permissions block: they fall back to the repository/organization
default, which for repos created before February 2023 is read-write.

Add 'permissions: contents: read' at the top of each workflow that only
needs to read the repository, and make the PyPI deploy job's existing
job-level block explicit about contents: read alongside id-token: write.
---
 .github/workflows/full_test.yml        | 3 +++
 .github/workflows/notebooks_test.yml   | 3 +++
 .github/workflows/python-publish.yml   | 4 ++++
 .github/workflows/scheduled_test.yml   | 3 +++
 .github/workflows/test_mikeio_main.yml | 3 +++
 5 files changed, 16 insertions(+)

diff --git a/.github/workflows/full_test.yml b/.github/workflows/full_test.yml
index bd62ad2b4..341923a71 100644
--- a/.github/workflows/full_test.yml
+++ b/.github/workflows/full_test.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/notebooks_test.yml b/.github/workflows/notebooks_test.yml
index dd64a1df6..ef39a8eb8 100644
--- a/.github/workflows/notebooks_test.yml
+++ b/.github/workflows/notebooks_test.yml
@@ -8,6 +8,9 @@ on:
     types: [review_requested, ready_for_review]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml
index fbb4cc526..8ba0c7e0d 100644
--- a/.github/workflows/python-publish.yml
+++ b/.github/workflows/python-publish.yml
@@ -8,6 +8,9 @@ on:
     types: [published]
   workflow_dispatch:
     
+permissions:
+  contents: read
+
 jobs:
 
   test:
@@ -34,6 +37,7 @@ jobs:
     needs: test
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       # IMPORTANT: this permission is mandatory for trusted publishing
       id-token: write
 
diff --git a/.github/workflows/scheduled_test.yml b/.github/workflows/scheduled_test.yml
index 9af4045e9..2b99db358 100644
--- a/.github/workflows/scheduled_test.yml
+++ b/.github/workflows/scheduled_test.yml
@@ -7,6 +7,9 @@ on:
     # * is a special character in YAML so you have to quote this string
     - cron:  '0 5 */3 * *'
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
diff --git a/.github/workflows/test_mikeio_main.yml b/.github/workflows/test_mikeio_main.yml
index 03600008d..c542b081b 100644
--- a/.github/workflows/test_mikeio_main.yml
+++ b/.github/workflows/test_mikeio_main.yml
@@ -8,6 +8,9 @@ on:
     # Run weekly on Mondays at 5:00 AM UTC
     - cron: '0 5 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   test-mikeio-main:
     runs-on: ubuntu-latest