From 77314c8901f9d74726c2ddbcfe5ba8385bf917f2 Mon Sep 17 00:00:00 2001
From: Satoshi Qazi Muhammed <info@pezkuwichain.io>
Date: Fri, 2 Oct 2026 21:16:56 +0400
Subject: [PATCH] ci: restrict default GITHUB_TOKEN permissions to contents:
 read

None of these workflows write through GITHUB_TOKEN: artifact upload,
Firebase, S3, Play Store, gh-pages and the Appium dispatch all use their
own credentials. Reusable workflows they call inherit the same cap.
---
 .github/workflows/appium-mobile-tests.yml          | 3 +++
 .github/workflows/balances_test.yml                | 3 +++
 .github/workflows/code-quality.yml                 | 3 +++
 .github/workflows/distribute_app_to_play_store.yml | 3 +++
 .github/workflows/manual_firebase_distribution.yml | 3 +++
 .github/workflows/pull_request.yml                 | 3 +++
 .github/workflows/push_develop.yml                 | 3 +++
 7 files changed, 21 insertions(+)

diff --git a/.github/workflows/appium-mobile-tests.yml b/.github/workflows/appium-mobile-tests.yml
index 497fbbf6..7a564e0e 100644
--- a/.github/workflows/appium-mobile-tests.yml
+++ b/.github/workflows/appium-mobile-tests.yml
@@ -34,6 +34,9 @@ env:
   ALLURE_ENDPOINT: https://pezkuwi.testops.cloud/
   ALLURE_PROJECT_ID: 103
 
+permissions:
+  contents: read
+
 jobs:
   trigger-tests:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/balances_test.yml b/.github/workflows/balances_test.yml
index 9b5f57d4..02059794 100644
--- a/.github/workflows/balances_test.yml
+++ b/.github/workflows/balances_test.yml
@@ -6,6 +6,9 @@ on:
   schedule:
     - cron: '0 */8 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   build-app:
     uses: pezkuwichain/pezkuwi-wallet-android/.github/workflows/android_build.yml@main
diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml
index 8f96d1b1..3d52bc09 100644
--- a/.github/workflows/code-quality.yml
+++ b/.github/workflows/code-quality.yml
@@ -29,6 +29,9 @@ env:
   DEBUG_GOOGLE_OAUTH_ID: ${{ secrets.DEBUG_GOOGLE_OAUTH_ID }}
   RELEASE_GOOGLE_OAUTH_ID: ${{ secrets.RELEASE_GOOGLE_OAUTH_ID }}
 
+permissions:
+  contents: read
+
 jobs:
   ktlint:
     name: Kotlin Lint
diff --git a/.github/workflows/distribute_app_to_play_store.yml b/.github/workflows/distribute_app_to_play_store.yml
index f1c9545c..b246d853 100644
--- a/.github/workflows/distribute_app_to_play_store.yml
+++ b/.github/workflows/distribute_app_to_play_store.yml
@@ -35,6 +35,9 @@ on:
         default: '0.2'
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   build:
     uses: pezkuwichain/pezkuwi-wallet-android/.github/workflows/android_build.yml@main
diff --git a/.github/workflows/manual_firebase_distribution.yml b/.github/workflows/manual_firebase_distribution.yml
index 5de73858..e5f39cc9 100644
--- a/.github/workflows/manual_firebase_distribution.yml
+++ b/.github/workflows/manual_firebase_distribution.yml
@@ -20,6 +20,9 @@ on:
         required: true
         default: main
 
+permissions:
+  contents: read
+
 jobs:
   build:
     uses: pezkuwichain/pezkuwi-wallet-android/.github/workflows/android_build.yml@main
diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
index 1e9a1a8c..c0232689 100644
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -11,6 +11,9 @@ on:
         type: string
 
 
+permissions:
+  contents: read
+
 jobs:
   test:
     uses: pezkuwichain/pezkuwi-wallet-android/.github/workflows/android_build.yml@main
diff --git a/.github/workflows/push_develop.yml b/.github/workflows/push_develop.yml
index 7aa5ff80..912981b9 100644
--- a/.github/workflows/push_develop.yml
+++ b/.github/workflows/push_develop.yml
@@ -5,6 +5,9 @@ on:
     branches: [main]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     uses: pezkuwichain/pezkuwi-wallet-android/.github/workflows/android_build.yml@main