.github/workflows/ci.yml

@@ -9,8 +9,14 @@ on:
 env:
   CARGO_TERM_COLOR: always
 
+permissions:
+  contents: read
+
 jobs:
   test:
+    permissions:
+      contents: read
+      checks: write
     name: Test
     runs-on: ubuntu-latest
     strategy:

.github/workflows/dependabot.yml

@@ -4,8 +4,14 @@ on:
   pull_request:
     types: [opened, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   dependabot:
+    permissions:
+      contents: write
+      pull-requests: write
     runs-on: ubuntu-latest
     if: github.actor == 'dependabot[bot]'
     steps:

.github/workflows/release.yml

@@ -8,8 +8,13 @@ on:
 env:
   CARGO_TERM_COLOR: always
 
+permissions:
+  contents: read
+
 jobs:
   create-release:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     outputs:
       upload_url: ${{ steps.create_release.outputs.upload_url }}
@@ -29,6 +34,8 @@ jobs:
           prerelease: false
 
   build:
+    permissions:
+      contents: write
     needs: create-release
     strategy:
       matrix: