set permissions

.github/workflows/changelog_stage.yml

@@ -1,6 +1,9 @@
 name: Changelog stage
 on:
   workflow_call:
+permissions:
+  contents: read
+
 jobs:
   prepare:
     runs-on: ubuntu-latest

.github/workflows/common_deploy_jobs.yml

@@ -10,6 +10,8 @@ on:
         description: 'snap channel to release to'
         required: true
         type: string
+permissions:
+  contents: read
 
 jobs:
   # This job relies on credentials used to publish the Certbot snaps. This
@@ -30,8 +32,6 @@ jobs:
   publish_snap:
     name: Publish snap
     if: ${{ inputs.snapReleaseChannel == 'edge' || inputs.snapReleaseChannel == 'beta' }}
-    permissions:
-      contents: read
     runs-on:
       - 'ubuntu-24.04'
     strategy:
@@ -95,8 +95,6 @@ jobs:
   # https://github.com/docker/login-action?tab=readme-ov-file#docker-hub
   publish_docker_by_arch:
     name: Publish docker by arch
-    permissions:
-      contents: read
     runs-on:
       - 'ubuntu-24.04'
     strategy:
@@ -128,8 +126,6 @@ jobs:
   publish_docker_multiarch:
     name: Publish docker multiarch
     needs: publish_docker_by_arch
-    permissions:
-      contents: read
     runs-on:
       - 'ubuntu-24.04'
     steps:

.github/workflows/extended_tests_jobs.yml

@@ -2,11 +2,11 @@
 name: Extended tests jobs
 on:
   workflow_call:
+permissions:
+  contents: read
 
 jobs:
   test:
-    permissions:
-      contents: read
     strategy:
       fail-fast: false
       matrix:

.github/workflows/full-test-suite.yml

@@ -7,6 +7,8 @@ on:
     # "Running tests in CI" is still correct.
     - test-*
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   test_and_package_stage:

.github/workflows/nightly.yml

@@ -8,6 +8,8 @@ on:
 jobs:
   test_and_package_stage:
     name: Test and Package
+    permissions:
+      contents: read
     uses: "./.github/workflows/test_and_package_stage.yml"
     with:
       dockerTag: nightly
@@ -15,9 +17,13 @@ jobs:
     secrets: inherit
   changelog_stage:
     name: Create changelog
+    permissions:
+      contents: read
     uses: "./.github/workflows/changelog_stage.yml"
   nightly_deploy_stage:
     name: Nightly deploy
+    permissions:
+      contents: read
     needs: test_and_package_stage
     uses: "./.github/workflows/common_deploy_jobs.yml"
     secrets: inherit
@@ -30,6 +36,9 @@ jobs:
     - changelog_stage
     - nightly_deploy_stage
     if: failure() && fromJSON(github.run_attempt) < 3
+    permissions:
+      actions: write
+      checks: write
     runs-on: ubuntu-latest
     steps:
       - env:

.github/workflows/packaging_jobs.yml

@@ -9,6 +9,8 @@ on:
       snapBuildTimeout:
         description: 'timeout for snap builds'
         type: number
+permissions:
+  contents: read
 
 env:
   dockerTag: ${{ inputs.dockerTag }}

.github/workflows/pr-test-suite.yml

@@ -10,16 +10,18 @@ on:
     - main
     - "*.x"
   workflow_dispatch:
+permissions:
+  contents: read
 concurrency:
   # https://stackoverflow.com/questions/74117321/if-condition-in-concurrency-in-gha
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
   cancel-in-progress: true
+
 jobs:
   standard_tests_jobs:
     name: standard_tests_jobs
     uses: "./.github/workflows/standard_tests_jobs.yml"
-    permissions:
-      contents: read
+
     with:
       # We set this here to avoid coverage data being uploaded from things like our
       # nightly pipeline. This is done because codecov (helpfully) keeps track of

.github/workflows/rerun.yml

@@ -3,6 +3,10 @@ on:
     inputs:
       run_id:
         required: true
+permissions:
+  actions: write
+  checks: write
+
 jobs:
   rerun:
     runs-on: ubuntu-latest

.github/workflows/standard_tests_jobs.yml

@@ -7,10 +7,11 @@ on:
         description: 'Upload coverage to Codecov'
         type: boolean
         default: false
+permissions:
+  contents: read
+
 jobs:
   test:
-    permissions:
-      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -45,8 +46,6 @@ jobs:
       IMAGE_NAME: "${{ matrix.IMAGE_NAME }}"
       test_name: "test"
   test_sphinx_builds:
-    permissions:
-      contents: read
     runs-on:
       - ubuntu-22.04
     steps:

.github/workflows/test_and_package_stage.yml

@@ -9,24 +9,20 @@ on:
       snapBuildTimeout:
         description: 'timeout for snap builds'
         type: number
+permissions:
+  contents: read
 
 jobs:
   standard_tests_jobs:
     name: standard_tests_jobs
     uses: "./.github/workflows/standard_tests_jobs.yml"
-    permissions:
-      contents: read
   extended_tests_jobs:
     name: extended_tests_jobs
     uses: "./.github/workflows/extended_tests_jobs.yml"
-    permissions:
-      contents: read
     secrets: inherit
   packaging_jobs:
     name: packaging_jobs
     uses: "./.github/workflows/packaging_jobs.yml"
-    permissions:
-      contents: read
     with:
       dockerTag: ${{ inputs.dockerTag }}
       snapBuildTimeout: ${{ inputs.snapBuildTimeout }}

.github/workflows/tox_steps.yml

@@ -25,6 +25,8 @@ on:
         type: string
       test_name:
         type: string
+permissions:
+  contents: read
 
 env:
   uploadCoverage: ${{ inputs.uploadCoverage }}