From 1a4d109f696d6923d9abd50d956d73c52e4d040f Mon Sep 17 00:00:00 2001
From: Satoshi Qazi Muhammed <info@pezkuwichain.io>
Date: Tue, 20 Oct 2026 22:29:20 +0400
Subject: [PATCH] ci: give every workflow an explicit least-privilege
 GITHUB_TOKEN

CodeQL actions/missing-workflow-permissions: chain-endpoints.yml, lock.yml, pr-any.yml, test-nightly.yml had no permissions block, so their jobs received the repository default token. Read-only where nothing writes through GITHUB_TOKEN; lock-threads gets the issues/pull-requests/discussions write it documents; workflows that write do it with a separate bot or app token, so GITHUB_TOKEN stays read-only.
---
 .github/workflows/chain-endpoints.yml | 6 ++++++
 .github/workflows/lock.yml            | 7 +++++++
 .github/workflows/pr-any.yml          | 5 +++++
 .github/workflows/test-nightly.yml    | 5 +++++
 4 files changed, 23 insertions(+)

diff --git a/.github/workflows/chain-endpoints.yml b/.github/workflows/chain-endpoints.yml
index 496d71f..2150ffe 100644
--- a/.github/workflows/chain-endpoints.yml
+++ b/.github/workflows/chain-endpoints.yml
@@ -6,6 +6,12 @@ on:
     # once daily (early mornings, 02:50 GMT, generally not busy)
     - cron:  '50 2 * * *'
 
+
+# GITHUB_TOKEN only opens an issue when the endpoint check fails.
+permissions:
+  contents: read
+  issues: write
+
 jobs:
   endpoints:
     if: github.repository == 'pezkuwichain/pezkuwi-apps'
diff --git a/.github/workflows/lock.yml b/.github/workflows/lock.yml
index 978c680..cba69fb 100644
--- a/.github/workflows/lock.yml
+++ b/.github/workflows/lock.yml
@@ -5,6 +5,13 @@ on:
   schedule:
     - cron: '15 2/3 * * *'
 
+
+# dessant/lock-threads locks closed issues, PRs and discussions.
+permissions:
+  issues: write
+  pull-requests: write
+  discussions: write
+
 jobs:
   lock:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/pr-any.yml b/.github/workflows/pr-any.yml
index b751dbe..c7f5f92 100644
--- a/.github/workflows/pr-any.yml
+++ b/.github/workflows/pr-any.yml
@@ -1,6 +1,11 @@
 name: PR
 on: [pull_request]
 
+
+# Read-only token: no step writes through GITHUB_TOKEN.
+permissions:
+  contents: read
+
 jobs:
   pr:
     strategy:
diff --git a/.github/workflows/test-nightly.yml b/.github/workflows/test-nightly.yml
index d7d2ea3..9128839 100644
--- a/.github/workflows/test-nightly.yml
+++ b/.github/workflows/test-nightly.yml
@@ -5,6 +5,11 @@ on:
     - cron:  '1 5 * * *'
 
 
+
+# Read-only token: no step writes through GITHUB_TOKEN.
+permissions:
+  contents: read
+
 jobs:
   alltests:
     strategy: