From: Marc Fehling <mafehling.git@gmail.com>
Date: Tue, 10 May 2022 17:15:15 +0000 (-0600)
Subject: Restrict permissions for GITHUB_TOKEN.
X-Git-Tag: v9.4.0-rc1~218^2
X-Git-Url: https://gitweb.dealii.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F13712%2Fhead;p=dealii.git

Restrict permissions for GITHUB_TOKEN.
---

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index ca87f319f7..853d90890a 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -4,6 +4,10 @@ on:
   push: 
     branches: [master]
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   build-master-docker:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/indent.yml b/.github/workflows/indent.yml
index eae7be5a0f..e7474201cc 100644
--- a/.github/workflows/indent.yml
+++ b/.github/workflows/indent.yml
@@ -6,6 +6,9 @@ concurrency:
   group: ${ {github.event_name }}-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{github.event_name == 'pull_request'}}
 
+permissions:
+  contents: read
+
 jobs:
   indent:
     # run the indent checks
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 38d72c4aea..b73ee3ad60 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -6,6 +6,9 @@ concurrency:
   group: ${ {github.event_name }}-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{github.event_name == 'pull_request'}}
 
+permissions:
+  contents: read
+
 jobs:
   linux-release-serial:
     # simple serial release build using g++
diff --git a/.github/workflows/osx.yml b/.github/workflows/osx.yml
index fce0866b32..17518d8a6d 100644
--- a/.github/workflows/osx.yml
+++ b/.github/workflows/osx.yml
@@ -6,6 +6,9 @@ concurrency:
   group: ${ {github.event_name }}-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{github.event_name == 'pull_request'}}
 
+permissions:
+  contents: read
+
 jobs:
   osx-serial:
     # simple serial build using apple clang
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index b46066f105..8c09e66cd2 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -6,6 +6,9 @@ concurrency:
   group: ${ {github.event_name }}-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{github.event_name == 'pull_request'}}
 
+permissions:
+  contents: read
+
 jobs:
   windows-serial:
     # Serial build on Windows