From 8527131b3eaba85c33629176d59223c3fbce7677 Mon Sep 17 00:00:00 2001
From: roottool <operation.versatile.roottool@gmail.com>
Date: Sun, 15 Feb 2026 15:42:57 +0900
Subject: [PATCH] ci: add top-level permissions to workflow files

Add explicit top-level `permissions` to 5 workflow files that were
missing them, following GitHub Actions security best practices for
least-privilege token scoping.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/ci.yml                   | 4 ++++
 .github/workflows/wc-export-validation.yml | 3 +++
 .github/workflows/wc-lint-format.yml       | 3 +++
 .github/workflows/wc-test.yml              | 3 +++
 .github/workflows/wc-type-check.yml        | 3 +++
 5 files changed, 16 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f671ee2..3e0818e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,6 +8,9 @@ on:
     branches: [main]
     types: [opened, synchronize, reopened, ready_for_review]
 
+permissions:
+  contents: read
+
 defaults:
   run:
     shell: bash
@@ -25,6 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 2
     permissions:
+      contents: read
       pull-requests: read
     if: ${{ !github.event.pull_request.draft }}
     outputs:
diff --git a/.github/workflows/wc-export-validation.yml b/.github/workflows/wc-export-validation.yml
index d587002..d925e4d 100644
--- a/.github/workflows/wc-export-validation.yml
+++ b/.github/workflows/wc-export-validation.yml
@@ -3,6 +3,9 @@ run-name: "${{ github.workflow }} (${{ github.ref_name }}): ${{ github.event.pul
 
 on: workflow_call
 
+permissions:
+  contents: read
+
 defaults:
   run:
     shell: bash
diff --git a/.github/workflows/wc-lint-format.yml b/.github/workflows/wc-lint-format.yml
index bc0df82..442510f 100644
--- a/.github/workflows/wc-lint-format.yml
+++ b/.github/workflows/wc-lint-format.yml
@@ -3,6 +3,9 @@ run-name: "${{ github.workflow }} (${{ github.ref_name }}): ${{ github.event.pul
 
 on: workflow_call
 
+permissions:
+  contents: read
+
 defaults:
   run:
     shell: bash
diff --git a/.github/workflows/wc-test.yml b/.github/workflows/wc-test.yml
index 0cb9b94..16c4531 100644
--- a/.github/workflows/wc-test.yml
+++ b/.github/workflows/wc-test.yml
@@ -8,6 +8,9 @@ on:
         description: Token for Codecov upload
         required: true
 
+permissions:
+  contents: read
+
 defaults:
   run:
     shell: bash
diff --git a/.github/workflows/wc-type-check.yml b/.github/workflows/wc-type-check.yml
index d6fec4c..622ae4e 100644
--- a/.github/workflows/wc-type-check.yml
+++ b/.github/workflows/wc-type-check.yml
@@ -3,6 +3,9 @@ run-name: "${{ github.workflow }} (${{ github.ref_name }}): ${{ github.event.pul
 
 on: workflow_call
 
+permissions:
+  contents: read
+
 defaults:
   run:
     shell: bash