From c20eb87e8a792c25669dbc08eeb7b4ee4da729ad Mon Sep 17 00:00:00 2001
From: Mohammad Abdolirad <m.abdolirad@gmail.com>
Date: Mon, 3 Aug 2026 23:44:39 +0200
Subject: [PATCH] tighten GITHUB_TOKEN workflow permissions

---
 .github/workflows/osv-scanner-pr.yml        | 11 ++++++-----
 .github/workflows/osv-scanner-scheduled.yml | 11 ++++++-----
 .github/workflows/release.yml               |  1 -
 3 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/osv-scanner-pr.yml b/.github/workflows/osv-scanner-pr.yml
index 1cd4754..a668ad8 100644
--- a/.github/workflows/osv-scanner-pr.yml
+++ b/.github/workflows/osv-scanner-pr.yml
@@ -7,13 +7,14 @@ on:
     branches: [main]
 
 permissions:
-  # Required to upload SARIF file to CodeQL. See: https://github.com/github/codeql-action/issues/2117
-  actions: read
-  # Require writing security events to upload SARIF file to security tab
-  security-events: write
-  # Only need to read contents
   contents: read
 
 jobs:
   scan-pr:
+    permissions:
+      # Required to upload SARIF file to CodeQL. See: https://github.com/github/codeql-action/issues/2117
+      actions: read
+      # Require writing security events to upload SARIF file to security tab
+      security-events: write
+      contents: read
     uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8
diff --git a/.github/workflows/osv-scanner-scheduled.yml b/.github/workflows/osv-scanner-scheduled.yml
index 84864ee..395b6de 100644
--- a/.github/workflows/osv-scanner-scheduled.yml
+++ b/.github/workflows/osv-scanner-scheduled.yml
@@ -7,15 +7,16 @@ on:
     branches: [main]
 
 permissions:
-  # Required to upload SARIF file to CodeQL. See: https://github.com/github/codeql-action/issues/2117
-  actions: read
-  # Require writing security events to upload SARIF file to security tab
-  security-events: write
-  # Only need to read contents
   contents: read
 
 jobs:
   scan-scheduled:
+    permissions:
+      # Required to upload SARIF file to CodeQL. See: https://github.com/github/codeql-action/issues/2117
+      actions: read
+      # Require writing security events to upload SARIF file to security tab
+      security-events: write
+      contents: read
     uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8
     with:
       fail-on-vuln: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 808bb59..1304c37 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -92,7 +92,6 @@ jobs:
     needs: [osv-container-scan]
     permissions:
       contents: write
-      packages: write
       discussions: write
       id-token: write
     steps: