From bf624dd44449448796d61864e4689b2d90701b3b Mon Sep 17 00:00:00 2001
From: Satoshi Qazi Muhammed <info@pezkuwichain.io>
Date: Tue, 20 Oct 2026 22:29:37 +0400
Subject: [PATCH] ci: give every workflow an explicit least-privilege
 GITHUB_TOKEN

CodeQL actions/missing-workflow-permissions: lock.yml, pr-any.yml had no permissions block, so their jobs received the repository default token. Read-only where nothing writes through GITHUB_TOKEN; lock-threads gets the issues/pull-requests/discussions write it documents; workflows that write do it with a separate bot or app token, so GITHUB_TOKEN stays read-only.
---
 .github/workflows/lock.yml   | 7 +++++++
 .github/workflows/pr-any.yml | 5 +++++
 2 files changed, 12 insertions(+)

diff --git a/.github/workflows/lock.yml b/.github/workflows/lock.yml
index da2ca9f0..d40c4597 100644
--- a/.github/workflows/lock.yml
+++ b/.github/workflows/lock.yml
@@ -5,6 +5,13 @@ on:
   schedule:
     - cron: '25 2/3 * * *'
 
+
+# dessant/lock-threads locks closed issues, PRs and discussions.
+permissions:
+  issues: write
+  pull-requests: write
+  discussions: write
+
 jobs:
   lock:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/pr-any.yml b/.github/workflows/pr-any.yml
index 4b1b7295..4522ffb0 100644
--- a/.github/workflows/pr-any.yml
+++ b/.github/workflows/pr-any.yml
@@ -1,6 +1,11 @@
 name: PR
 on: [pull_request]
 
+
+# Read-only token: no step writes through GITHUB_TOKEN.
+permissions:
+  contents: read
+
 jobs:
   pr:
     strategy: