update CI permissions

purificant · purificant · commit c5909ec62563 · 2026-04-14T16:04:39.000+01:00
diff --git a/.github/workflows/codescan.yaml b/.github/workflows/codescan.yaml
@@ -8,6 +8,9 @@ on:
   schedule:
     - cron: '0 0 * * 0' # weekly
 
+permissions:
+  contents: read
+
 jobs:
   code-ql:
     name: CodeQL
diff --git a/.github/workflows/release_pypi.yaml b/.github/workflows/release_pypi.yaml
@@ -2,6 +2,9 @@ name: release pypi
 # when manually triggered
 on: workflow_dispatch
 
+permissions:
+  contents: read
+
 jobs:
   release_pypi:
     name: PyPI release
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
@@ -10,6 +10,9 @@ on:
   schedule:
     - cron: '0 0 * * 0' # weekly
 
+permissions:
+  contents: read
+
 jobs:
   # run tests
   test:
