From 70aafc41bbbd763ba2f94904627d3018ace5a7ae Mon Sep 17 00:00:00 2001
From: Quentin Gliech <quenting@element.io>
Date: Tue, 25 Jan 2022 15:47:58 +0100
Subject: [PATCH] ci: explicit jobs permissions

---
 .github/workflows/check.yaml | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/.github/workflows/check.yaml b/.github/workflows/check.yaml
index 25583365e..de4b7c446 100644
--- a/.github/workflows/check.yaml
+++ b/.github/workflows/check.yaml
@@ -13,6 +13,9 @@ jobs:
     name: Fetch Cargo dependencies
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+
     steps:
       - name: Checkout the code
         uses: actions/checkout@v2
@@ -64,6 +67,9 @@ jobs:
     needs: [fetch]
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+
     steps:
       - name: Checkout the code
         uses: actions/checkout@v2
@@ -106,6 +112,9 @@ jobs:
     needs: [fetch]
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+
     steps:
       - name: Checkout the code
         uses: actions/checkout@v2
@@ -148,6 +157,9 @@ jobs:
     needs: [rustfmt, clippy, fetch]
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+
     continue-on-error: "${{ matrix.toolchain == 'beta' || matrix.toolchain == 'nightly' }}"
 
     strategy:
@@ -200,6 +212,9 @@ jobs:
     needs: [rustfmt, clippy, fetch]
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+
     steps:
       - name: Checkout the code
         uses: actions/checkout@v2
@@ -266,6 +281,10 @@ jobs:
     env:
       IMAGE: ghcr.io/matrix-org/matrix-authentication-service
 
+    permissions:
+      packages: write
+      contents: read
+
     steps:
       - name: Checkout the code
         uses: actions/checkout@v2