chore(ci): add explicit permissions to GitHub Actions workflows

Author: Lukas742

.github/workflows/build.yml

@@ -2,6 +2,8 @@ name: 'Build w/ React18 & 19'
 
 on:
   workflow_call:
+permissions:
+  contents: read
 
 jobs:
   build:

.github/workflows/chromatic.yml

@@ -3,6 +3,10 @@ name: 'chromatic'
 on:
   push:
   workflow_dispatch:
+permissions:
+  contents: read
+  pull-requests: write # Chromatic posts PR comments
+  statuses: write # Chromatic posts commit statuses
 
 jobs:
   chromatic:

.github/workflows/examples.yml

@@ -13,6 +13,8 @@ on:
       - 'examples/**/*'
       - 'templates/**/*'
       - 'patterns/navigation-layout/**/*'
+permissions:
+  contents: read
 
 jobs:
   examples:

.github/workflows/main.yml

@@ -17,6 +17,8 @@ on:
 jobs:
   reuse-compliance:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
@@ -26,6 +28,9 @@ jobs:
   check-bundle-size:
     if: ${{ github.base_ref == 'main' }} # only for PRs targeting main branch
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write # compressed-size-action posts PR comments
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
@@ -37,14 +42,22 @@ jobs:
           clean-script: 'clean:remove-modules'
 
   build:
+    permissions:
+      contents: read
     uses: './.github/workflows/build.yml'
 
   test:
     needs: ['build']
+    permissions:
+      contents: read
+      pull-requests: write # coveralls posts coverage status
+      checks: write # coveralls creates check runs
     uses: './.github/workflows/test.yml'
 
   lint:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     env:
       CYPRESS_INSTALL_BINARY: 0
     steps:
@@ -66,6 +79,8 @@ jobs:
   deploy-next-docs:
     needs: ['build']
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # pushes to gh-pages branch
     env:
       CYPRESS_INSTALL_BINARY: 0
     steps:

.github/workflows/open-source-security.yml

@@ -7,6 +7,8 @@ on:
   schedule:
     - cron: '12 3 * * *'
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   piper-oss:

.github/workflows/release-comments.yml

@@ -2,6 +2,9 @@ name: 'Issue Comments'
 
 on:
   workflow_dispatch:
+# All write operations use secrets.ACCESS_TOKEN (PAT), not GITHUB_TOKEN
+permissions:
+  contents: read
 
 jobs:
   issue-comment:

.github/workflows/release-custom-tag.yml

@@ -14,6 +14,8 @@ on:
 
 jobs:
   test:
+    permissions:
+      contents: read
     uses: './.github/workflows/test.yml'
     with:
       reportCoverage: false

.github/workflows/release.yml

@@ -27,11 +27,15 @@ on:
 jobs:
   build:
     if: ${{ github.event.inputs.publish_only != 'true' }}
+    permissions:
+      contents: read
     uses: './.github/workflows/build.yml'
 
   test:
     if: ${{ github.event.inputs.publish_only != 'true' }}
     needs: ['build']
+    permissions:
+      contents: read
     uses: './.github/workflows/test.yml'
     with:
       reportCoverage: false

.github/workflows/stale.yml

@@ -3,6 +3,9 @@ name: Mark and close stale issues
 on:
   schedule:
     - cron: '30 1 * * *'
+permissions:
+  issues: write # Label, comment, and close stale issues
+  pull-requests: write # Label, comment, and close stale PRs
 
 jobs:
   stale:

.github/workflows/test.yml

@@ -7,6 +7,10 @@ on:
         default: true
         type: boolean
         required: false
+permissions:
+  contents: read
+  pull-requests: write # coveralls posts coverage status
+  checks: write # coveralls creates check runs
 
 jobs:
   mcp-server: