Specify permissions for the GitHub Actions

.github/workflows/ci-devel.yml

@@ -1,5 +1,8 @@
 name: CI - Devel scripts
 
+permissions:
+  contents: read
+
 on:
   push:
     paths:

.github/workflows/ci-doc-check.yml

@@ -1,5 +1,8 @@
 name: "CI - Documentation Check"
 
+permissions:
+  contents: read
+
 on:
   push:
     paths:

.github/workflows/ci-integration-tests.yml

@@ -1,5 +1,8 @@
 name: "CI - Integration Tests"
 
+permissions:
+  contents: read
+
 on:
   schedule:
     # at 9:45 UTC every day from Monday to Friday

.github/workflows/ci-live.yml

@@ -1,5 +1,8 @@
 name: CI - ISO definition
 
+permissions:
+  contents: read
+
 on:
   push:
     paths:

.github/workflows/ci-rubocop.yml

@@ -1,5 +1,8 @@
 name: "CI - Rubocop"
 
+permissions:
+  contents: read
+
 on:
   push:
     paths:

.github/workflows/ci-rust.yml

@@ -1,6 +1,8 @@
 name: CI - Rust
+
 permissions:
   contents: read
+
 on:
   push:
     paths:

.github/workflows/ci-service.yml

@@ -1,6 +1,8 @@
 name: CI - Service
+
 permissions:
   contents: read
+
 on:
   push:
     paths:

.github/workflows/ci-web.yml

@@ -1,6 +1,8 @@
 name: CI - Web
+
 permissions:
   contents: read
+
 on:
   push:
     paths:

.github/workflows/obs-service-shared.yml

@@ -2,6 +2,9 @@
 
 name: Update OBS Service Package
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
     secrets:

.github/workflows/obs-staging-autoinstallation.yml

@@ -1,5 +1,8 @@
 name: Submit agama-auto
 
+permissions:
+  contents: read
+
 on:
   # runs on pushes targeting the default branch
   push:

.github/workflows/obs-staging-live.yml

@@ -1,5 +1,8 @@
 name: Submit agama-installer
 
+permissions:
+  contents: read
+
 on:
   push:
     paths:

.github/workflows/obs-staging-products.yml

@@ -1,5 +1,8 @@
 name: Submit agama-products
 
+permissions:
+  contents: read
+
 on:
   push:
     paths:

.github/workflows/obs-staging-rust.yml

@@ -1,5 +1,8 @@
 name: Submit agama
 
+permissions:
+  contents: read
+
 on:
   push:
     paths:

.github/workflows/obs-staging-service.yml

@@ -1,5 +1,8 @@
 name: Submit rubygem-agama-yast
 
+permissions:
+  contents: read
+
 on:
   push:
     paths:

.github/workflows/obs-staging-shared.yml

@@ -2,6 +2,9 @@
 
 name: Update OBS Packages
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
     secrets:

.github/workflows/obs-staging-web.yml

@@ -1,5 +1,8 @@
 name: Submit agama-web-ui
 
+permissions:
+  contents: read
+
 on:
   push:
     paths:

.github/workflows/weblate-merge-po.yml

@@ -1,5 +1,10 @@
 name: Weblate Merge PO
 
+permissions:
+  # it merges the updated translations and creates a pull request with the changes
+  contents: write
+  pull-requests: write
+
 on:
   schedule:
     # run every Monday at 2:42AM UTC

.github/workflows/weblate-merge-products-po.yml

@@ -1,5 +1,10 @@
 name: Weblate Merge Product PO
 
+permissions:
+  # it merges the updated translations and creates a pull request with the changes
+  contents: write
+  pull-requests: write
+
 on:
   schedule:
     # run every Monday at 2:45AM UTC

.github/workflows/weblate-merge-service-po.yml

@@ -1,5 +1,10 @@
 name: Weblate Merge Service PO
 
+permissions:
+  # it merges the updated translations and creates a pull request with the changes
+  contents: write
+  pull-requests: write
+
 on:
   schedule:
     # run every Monday at 2:45AM UTC

.github/workflows/weblate-update-pot.yml

@@ -1,5 +1,9 @@
 name: Weblate Update POT
 
+permissions:
+  # this action uploads the updated POT files to the agama-weblate repository
+  contents: write
+
 on:
   schedule:
     # run every working day (Monday-Friday) at 1:42AM UTC