From fba1989e0faaa7a986d3067e5a61377b4248b883 Mon Sep 17 00:00:00 2001
From: Satoshi Qazi Muhammed <info@pezkuwichain.io>
Date: Tue, 20 Oct 2026 22:29:31 +0400
Subject: [PATCH] ci: give every workflow an explicit least-privilege
 GITHUB_TOKEN

CodeQL actions/missing-workflow-permissions: auto-approve.yml, auto-merge.yml, lock.yml, pr-any.yml, push-master.yml had no permissions block, so their jobs received the repository default token. Read-only where nothing writes through GITHUB_TOKEN; lock-threads gets the issues/pull-requests/discussions write it documents; workflows that write do it with a separate bot or app token, so GITHUB_TOKEN stays read-only.
---
 .github/workflows/auto-approve.yml | 5 +++++
 .github/workflows/auto-merge.yml   | 5 +++++
 .github/workflows/lock.yml         | 7 +++++++
 .github/workflows/pr-any.yml       | 5 +++++
 .github/workflows/push-master.yml  | 5 +++++
 5 files changed, 27 insertions(+)

diff --git a/.github/workflows/auto-approve.yml b/.github/workflows/auto-approve.yml
index 566790f..2bf9db9 100644
--- a/.github/workflows/auto-approve.yml
+++ b/.github/workflows/auto-approve.yml
@@ -4,6 +4,11 @@ on:
   pull_request:
     types: [labeled]
 
+
+# Writes go through a separate bot token or app token; GITHUB_TOKEN stays read-only.
+permissions:
+  contents: read
+
 jobs:
   approve:
     if: "! startsWith(github.event.head_commit.message, '[CI Skip]') && (!github.event.pull_request || github.event.pull_request.head.repo.full_name == github.repository)"
diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
index 155492f..ea0feef 100644
--- a/.github/workflows/auto-merge.yml
+++ b/.github/workflows/auto-merge.yml
@@ -4,6 +4,11 @@ on:
   pull_request:
     types: [labeled]
 
+
+# Writes go through a separate bot token or app token; GITHUB_TOKEN stays read-only.
+permissions:
+  contents: read
+
 jobs:
   merge:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lock.yml b/.github/workflows/lock.yml
index 1827333..2fe98a3 100644
--- a/.github/workflows/lock.yml
+++ b/.github/workflows/lock.yml
@@ -4,6 +4,13 @@ on:
   schedule:
     - cron: '30 1/3 * * *'
 
+
+# dessant/lock-threads locks closed issues, PRs and discussions.
+permissions:
+  issues: write
+  pull-requests: write
+  discussions: write
+
 jobs:
   lock:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/pr-any.yml b/.github/workflows/pr-any.yml
index fc190e1..e8224c6 100644
--- a/.github/workflows/pr-any.yml
+++ b/.github/workflows/pr-any.yml
@@ -1,6 +1,11 @@
 name: PR
 on: [pull_request]
 
+
+# Read-only token: no step writes through GITHUB_TOKEN.
+permissions:
+  contents: read
+
 jobs:
   pr:
     strategy:
diff --git a/.github/workflows/push-master.yml b/.github/workflows/push-master.yml
index 4082c93..3c4ba2c 100644
--- a/.github/workflows/push-master.yml
+++ b/.github/workflows/push-master.yml
@@ -4,6 +4,11 @@ on:
     branches:
       - master
 
+
+# Writes go through a separate bot token or app token; GITHUB_TOKEN stays read-only.
+permissions:
+  contents: read
+
 jobs:
   master:
     if: "! startsWith(github.event.head_commit.message, '[CI Skip]')"