From 46269729523252294bbe287e223ec8e17da90df7 Mon Sep 17 00:00:00 2001
From: Michael Geers <michael@geers.tv>
Date: Tue, 23 Sep 2025 19:34:34 +0200
Subject: [PATCH] Potential fix for code scanning alert no. 21: Workflow does
 not contain permissions (#23796)

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 .github/workflows/default.yml    | 2 ++
 .github/workflows/docs-issue.yml | 3 +++
 .github/workflows/nightly.yml    | 2 ++
 .github/workflows/release.yml    | 2 ++
 .github/workflows/stale.yaml     | 4 ++++
 .github/workflows/website.yml    | 2 ++
 6 files changed, 15 insertions(+)

diff --git a/.github/workflows/default.yml b/.github/workflows/default.yml
index 9908e835d..7f9e645fa 100644
--- a/.github/workflows/default.yml
+++ b/.github/workflows/default.yml
@@ -138,6 +138,8 @@ jobs:
 
   ui:
     name: UI
+    permissions:
+      contents: read
     runs-on: depot-ubuntu-24.04-arm
 
     steps:
diff --git a/.github/workflows/docs-issue.yml b/.github/workflows/docs-issue.yml
index 72e45cdb5..caf307873 100644
--- a/.github/workflows/docs-issue.yml
+++ b/.github/workflows/docs-issue.yml
@@ -1,4 +1,7 @@
 name: Create Documentation Issue
+permissions:
+  issues: write
+  contents: read
 
 on:
   pull_request_target:
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 8d6cf9983..ad580447a 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -1,4 +1,6 @@
 name: Nightly Build
+permissions:
+  contents: read
 
 on:
   schedule: # runs on the default branch: master
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d03196db0..881afc1d9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,6 +15,8 @@ jobs:
     needs:
       - call-build-workflow
     runs-on: depot-ubuntu-24.04-arm
+    permissions:
+      contents: read
 
     steps:
       - uses: actions/checkout@v5
diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml
index a3cd850f0..3196a4337 100644
--- a/.github/workflows/stale.yaml
+++ b/.github/workflows/stale.yaml
@@ -9,6 +9,10 @@ on:
 
 jobs:
   stale:
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
     runs-on: depot-ubuntu-24.04-arm
     steps:
       - uses: actions/stale@v9
diff --git a/.github/workflows/website.yml b/.github/workflows/website.yml
index 68feb9b67..6613d03f1 100644
--- a/.github/workflows/website.yml
+++ b/.github/workflows/website.yml
@@ -1,4 +1,6 @@
 name: Deploy data to website
+permissions:
+  contents: read
 
 on:
   release: