ChainSafe · LesnyRumcajs · Apr 2, 2026 · Apr 1, 2026 · Apr 1, 2026 · Apr 1, 2026
@@ -1,4 +1,6 @@
 name: Butterflynet checks
+permissions:
+  contents: read
 on:
   workflow_dispatch:
 env:

@@ -1,4 +1,7 @@
 name: cargo deny advisories
+permissions:
+  contents: read
+  issues: write
 on:
   workflow_dispatch:
   schedule:

@@ -1,4 +1,9 @@
 name: cargo publish dry run
+
+permissions:
+  contents: read
+  issues: write
+
 on:
   workflow_dispatch:
   schedule:

@@ -1,4 +1,6 @@
 name: Checkpoints Auto Update
+permissions:
+  contents: read
 
 on:
   workflow_dispatch:

@@ -1,4 +1,6 @@
 name: Code coverage
+permissions:
+  contents: read
 
 # Cancel workflow if there is a new change to the branch.
 concurrency:

@@ -1,4 +1,7 @@
 name: Curio devnet image
+permissions:
+  contents: read
+  packages: write
 
 # Only build and publish this image on demand.
 # The compilation adds significant overhead to the CI and it is not supposed

@@ -1,4 +1,7 @@
 name: Build Dev Docker Image
+permissions:
+  contents: read
+  packages: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ inputs.git_ref }}

@@ -1,6 +1,9 @@
 # Re-tag the given image and push it to the ghcr.io
 # Preserves the old tag.
 name: Docker Latest tag
+permissions:
+  contents: read
+  packages: write
 
 on:
   workflow_dispatch:

@@ -1,4 +1,6 @@
 name: Docker lint
+permissions:
+  contents: read
 
 # Cancel workflow if there is a new change to the branch.
 concurrency:

@@ -1,4 +1,7 @@
 name: Forest Docker
+permissions:
+  contents: read
+  packages: write
 
 # Cancel workflow if there is a new change to the branch.
 concurrency:

@@ -1,5 +1,8 @@
 # Checks periodically that the Dockerfile builds successfully, and if it doesn't, it creates an issue with the error message.
 name: Dockerfile Check
+permissions:
+  contents: read
+  issues: write
 
 on:
   workflow_dispatch:

@@ -1,5 +1,7 @@
 # This workflows, run daily, updates the Forest CLI usage docs, and submits a PR with the changes.
 name: Update Forest usage docs
+permissions:
+  contents: read
 
 on:
   workflow_dispatch:

@@ -1,4 +1,6 @@
 name: Docs Check
+permissions:
+  contents: read
 
 # Cancel workflow if there is a new change to the branch.
 concurrency:

@@ -2,6 +2,8 @@
 # We check that changes affect only the documentation and that no other changes are present. If this is the case, we trigger the no-op jobs.
 
 name: Docs Required Override
+permissions:
+  contents: read
 concurrency:
   group: "${{ github.workflow }}-${{ github.ref }}"
   cancel-in-progress: "${{ github.ref != 'refs/heads/main' }}"

@@ -1,5 +1,7 @@
 # This workflow, run daily, updates the Forest RPC reference docs, and submits a PR with the changes.
 name: Update Forest RPC reference docs
+permissions:
+  contents: read
 
 on:
   workflow_dispatch:

@@ -1,4 +1,7 @@
 name: Integration tests
+permissions:
+  contents: read
+  issues: write
 concurrency:
   group: "${{ github.workflow }}-${{ github.ref }}"
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

@@ -1,4 +1,6 @@
 name: Link Checker
+permissions:
+  contents: read
 
 on:
   workflow_dispatch:

@@ -1,4 +1,6 @@
 name: Lists lint
+permissions:
+  contents: read
 
 # Cancel workflow if there is a new change to the branch.
 concurrency:

@@ -1,6 +1,8 @@
 # This workflows, run daily, updates the Lotus version in the JSON-RPC API tests to the latest release,
 # and submits a PR with the changes.
 name: Update Lotus version in API tests
+permissions:
+  contents: read
 
 on:
   workflow_dispatch:

@@ -1,4 +1,7 @@
 name: Lotus devnet image
+permissions:
+  contents: read
+  packages: write
 
 # Only build and publish this image on demand.
 # The compilation adds significant overhead to the CI and it is not supposed

@@ -1,4 +1,6 @@
 name: Python lint
+permissions:
+  contents: read
 
 # Cancel workflow if there is a new change to the branch.
 concurrency:

@@ -8,6 +8,8 @@ on:
 jobs:
   build:
     name: Build
+    permissions:
+      contents: write
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
@@ -55,6 +57,8 @@ jobs:
 
   publish:
     name: cargo publish
+    permissions:
+      contents: read
     runs-on: ubuntu-24.04-arm
     steps:
       - uses: actions/checkout@v6

@@ -12,6 +12,8 @@ on:
 jobs:
   build:
     name: Build
+    permissions:
+      contents: write
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
@@ -58,6 +60,8 @@ jobs:
           prerelease: true
   publish:
     name: cargo publish
+    permissions:
+      contents: read
     runs-on: ubuntu-24.04-arm
     steps:
       - uses: actions/checkout@v6

@@ -1,4 +1,8 @@
 name: RPC parity conformance report
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
 on:
   workflow_dispatch:
     inputs:

@@ -1,4 +1,7 @@
 name: RPC parity tests
+permissions:
+  contents: read
+  issues: write
 on:
   workflow_dispatch:
     inputs:

@@ -1,4 +1,6 @@
 name: Rubocop
+permissions:
+  contents: read
 
 # Cancel workflow if there is a new change to the branch.
 concurrency:

@@ -1,4 +1,6 @@
 name: Rust code linters
+permissions:
+  contents: read
 
 # Cancel workflow if there is a new change to the branch.
 concurrency:

@@ -1,4 +1,6 @@
 name: Shellcheck
+permissions:
+  contents: read
 
 # Cancel workflow if there is a new change to the branch.
 concurrency:

@@ -1,4 +1,7 @@
 name: Snapshot parity test
+permissions:
+  contents: read
+  issues: write
 on:
   workflow_dispatch:
   schedule:

@@ -1,4 +1,7 @@
 name: This Month in Forest Reminder
+permissions:
+  contents: read
+  issues: write
 
 on:
   workflow_dispatch:

@@ -1,4 +1,6 @@
 name: Unit tests
+permissions:
+  contents: read
 
 # Cancel workflow if there is a new change to the branch.
 concurrency:

@@ -1,4 +1,6 @@
 name: YAML lint
+permissions:
+  contents: read
 
 # Cancel workflow if there is a new change to the branch.
 concurrency: