From 23b2ca9af474f7ea0335d41f2cbf84e7e95ee9e8 Mon Sep 17 00:00:00 2001
From: Veronica Berglyd Olsen <1619840+vkbo@users.noreply.github.com>
Date: Mon, 27 Oct 2025 21:22:32 +0100
Subject: [PATCH] Add read permission to all build jobs

---
 .github/workflows/build_assets.yml       | 2 ++
 .github/workflows/build_linux.yml        | 2 ++
 .github/workflows/build_mac.yml          | 4 ++++
 .github/workflows/build_win.yml          | 2 ++
 .github/workflows/build_win_launcher.yml | 2 ++
 5 files changed, 12 insertions(+)

diff --git a/.github/workflows/build_assets.yml b/.github/workflows/build_assets.yml
index 945b0634..263c8154 100644
--- a/.github/workflows/build_assets.yml
+++ b/.github/workflows/build_assets.yml
@@ -5,6 +5,8 @@ on: workflow_call
 jobs:
   buildAssets:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout Source
         uses: actions/checkout@v5
diff --git a/.github/workflows/build_linux.yml b/.github/workflows/build_linux.yml
index b1e62800..9db1c387 100644
--- a/.github/workflows/build_linux.yml
+++ b/.github/workflows/build_linux.yml
@@ -11,6 +11,8 @@ jobs:
     # Needs to stay on 22.04 as long as we're using manylinux_2_28
     # as libxcb-cursor0 in 22.04 supports glibc >= 2.17
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
     env:
       PYTHON_VERSION: "3.13"
       LINUX_TAG: "manylinux_2_28"
diff --git a/.github/workflows/build_mac.yml b/.github/workflows/build_mac.yml
index 1d708561..2a5d8240 100644
--- a/.github/workflows/build_mac.yml
+++ b/.github/workflows/build_mac.yml
@@ -9,6 +9,8 @@ jobs:
   buildMac-AMD64:
     needs: buildAssets
     runs-on: macos-latest
+    permissions:
+      contents: read
     env:
       PYTHON_VERSION: "3.13"
       PACKAGE_ARCH: x86_64
@@ -40,6 +42,8 @@ jobs:
   buildMac-M1:
     needs: buildAssets
     runs-on: macos-latest
+    permissions:
+      contents: read
     env:
       PYTHON_VERSION: "3.13"
       PACKAGE_ARCH: aarch64
diff --git a/.github/workflows/build_win.yml b/.github/workflows/build_win.yml
index 5c7bc616..180b8f19 100644
--- a/.github/workflows/build_win.yml
+++ b/.github/workflows/build_win.yml
@@ -9,6 +9,8 @@ jobs:
   buildWin64:
     needs: buildAssets
     runs-on: windows-2022
+    permissions:
+      contents: read
     steps:
       - name: Python Setup
         uses: actions/setup-python@v6
diff --git a/.github/workflows/build_win_launcher.yml b/.github/workflows/build_win_launcher.yml
index 59314e25..56928c69 100644
--- a/.github/workflows/build_win_launcher.yml
+++ b/.github/workflows/build_win_launcher.yml
@@ -5,6 +5,8 @@ on: workflow_dispatch
 jobs:
   buildLauncherWin64:
     runs-on: windows-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout Source
         uses: actions/checkout@v5