From 4744ca32316cc16f5ab65dc5f64772afa9a0a46f Mon Sep 17 00:00:00 2001
From: Felipe Knorr Kuhn <git@knorrium.info>
Date: Thu, 2 Apr 2026 15:05:02 +0900
Subject: [PATCH] Set explicit read permissions to all workflows

---
 .github/workflows/backend-integration.yml      | 3 +++
 .github/workflows/ci.yml                       | 3 +++
 .github/workflows/e2e_parameterized.yml        | 5 ++++-
 .github/workflows/get_backend_block_height.yml | 3 +++
 .github/workflows/get_backend_hash.yml         | 3 +++
 .github/workflows/get_image_digest.yml         | 6 +++++-
 .github/workflows/project-review-status.yml    | 3 +++
 .github/workflows/supply-chain-audit.yml       | 3 +++
 8 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/backend-integration.yml b/.github/workflows/backend-integration.yml
index 712c9ee19..0814e91ef 100644
--- a/.github/workflows/backend-integration.yml
+++ b/.github/workflows/backend-integration.yml
@@ -7,6 +7,9 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+
 jobs:
   backend-integration:
     if: "(github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ops') && !contains(github.head_ref, 'ops/')) || github.event_name == 'push'"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8265a12c7..468571f54 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,6 +7,9 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+
 jobs:
   backend:
     if: "(github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ops') && !contains(github.head_ref, 'ops/')) || github.event_name == 'push'"
diff --git a/.github/workflows/e2e_parameterized.yml b/.github/workflows/e2e_parameterized.yml
index ac4bca66d..e32f1c2fb 100644
--- a/.github/workflows/e2e_parameterized.yml
+++ b/.github/workflows/e2e_parameterized.yml
@@ -17,7 +17,10 @@ on:
         description: 'Liquid Hostname'
         required: true
         default: 'liquid.network'
-        type: string 
+        type: string
+
+permissions:
+  contents: read
 
 jobs:
   cache:
diff --git a/.github/workflows/get_backend_block_height.yml b/.github/workflows/get_backend_block_height.yml
index 73db6107e..90f712eee 100644
--- a/.github/workflows/get_backend_block_height.yml
+++ b/.github/workflows/get_backend_block_height.yml
@@ -2,6 +2,9 @@ name: 'Check if servers are in sync'
 
 on: [workflow_dispatch]
 
+permissions:
+  contents: read
+
 jobs:
   print-backend-sha:
     runs-on: mempool-ci
diff --git a/.github/workflows/get_backend_hash.yml b/.github/workflows/get_backend_hash.yml
index d63860c5e..947970362 100644
--- a/.github/workflows/get_backend_hash.yml
+++ b/.github/workflows/get_backend_hash.yml
@@ -2,6 +2,9 @@ name: 'Print backend hashes'
 
 on: [workflow_dispatch]
 
+permissions:
+  contents: read
+
 jobs:
   print-backend-sha:
     runs-on: mempool-ci
diff --git a/.github/workflows/get_image_digest.yml b/.github/workflows/get_image_digest.yml
index 3d86c860c..c8260f0a9 100644
--- a/.github/workflows/get_image_digest.yml
+++ b/.github/workflows/get_image_digest.yml
@@ -7,7 +7,11 @@ on:
         description: 'Image Version'
         required: false
         default: 'latest'
-        type: string 
+        type: string
+
+permissions:
+  contents: read
+
 jobs:
   print-images-sha:
     runs-on: mempool-ci
diff --git a/.github/workflows/project-review-status.yml b/.github/workflows/project-review-status.yml
index 523bbc22f..4d01cd628 100644
--- a/.github/workflows/project-review-status.yml
+++ b/.github/workflows/project-review-status.yml
@@ -6,6 +6,9 @@ on:
   issues:
     types: [opened]
 
+permissions:
+  contents: read
+
 jobs:
   project-automation:
     uses: mempool/.github/.github/workflows/project-board-automation.yml@master
diff --git a/.github/workflows/supply-chain-audit.yml b/.github/workflows/supply-chain-audit.yml
index ffdd4b2e2..521c7c543 100644
--- a/.github/workflows/supply-chain-audit.yml
+++ b/.github/workflows/supply-chain-audit.yml
@@ -7,6 +7,9 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+
 jobs:
   backend:
     if: "(github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ops') && !contains(github.head_ref, 'ops/')) || github.event_name == 'push'"