ci: add explicit permissions to all GitHub Actions workflows

.github/workflows/add-issue-to-triage-board.yml

@@ -6,6 +6,7 @@ on:
   pull_request_target:
     types:
       - opened
+permissions: {}
 jobs:
   add-to-triage-project-board:
     # skip in fork

.github/workflows/check-dist.yml

@@ -11,6 +11,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   check-dist:

.github/workflows/check-markdown.yml

@@ -5,6 +5,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   check-markdown:

.github/workflows/example-basic-pnpm.yml

@@ -5,6 +5,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   basic-pnpm:

.github/workflows/example-basic.yml

@@ -12,6 +12,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   basic:

.github/workflows/example-build-artifacts.yml

@@ -18,6 +18,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   build:

.github/workflows/example-chrome-for-testing.yml

@@ -5,6 +5,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   tests:

.github/workflows/example-chrome.yml

@@ -10,6 +10,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   tests:

.github/workflows/example-component-test.yml

@@ -5,6 +5,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   cypress-run:

.github/workflows/example-config.yml

@@ -10,6 +10,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   start:

.github/workflows/example-cron.yml

@@ -4,6 +4,8 @@ on:
     # runs tests every day at 4am
     - cron: '0 4 * * *'
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   nightly:

.github/workflows/example-custom-ci-build-id.yml

@@ -35,6 +35,9 @@ env:
   CYPRESS_PROJECT_ID: ${{ secrets.EXAMPLE_PROJECT_ID }}
   CYPRESS_RECORD_KEY: ${{ secrets.EXAMPLE_RECORDING_KEY }}
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+permissions:
+  contents: read
+  actions: read
 
 jobs:
   check-record-key:

.github/workflows/example-custom-command.yml

@@ -10,6 +10,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   start:

.github/workflows/example-debug.yml

@@ -14,6 +14,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   action-debug:

.github/workflows/example-docker.yml

@@ -5,6 +5,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   docker-browsers:

.github/workflows/example-edge.yml

@@ -5,6 +5,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   tests:

.github/workflows/example-env.yml

@@ -17,6 +17,9 @@ env:
   # Cypress.env('environmentName') // 'staging'
   # see https://on.cypress.io/env
   CYPRESS_environmentName: staging
+permissions:
+  contents: read
+
 jobs:
   e2e:
     runs-on: ubuntu-24.04

.github/workflows/example-expose.yml

@@ -10,6 +10,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   with-expose:

.github/workflows/example-firefox.yml

@@ -5,6 +5,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   firefox:

.github/workflows/example-install-command.yml

@@ -5,6 +5,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   install-command:

.github/workflows/example-install-only.yml

@@ -5,6 +5,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   # do not install every dependency in this example

.github/workflows/example-node-versions.yml

@@ -5,6 +5,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   cypress-run:

.github/workflows/example-quiet.yml

@@ -5,6 +5,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   cypress-run:

.github/workflows/example-recording.yml

@@ -23,6 +23,9 @@ env:
   CYPRESS_PROJECT_ID: ${{ secrets.EXAMPLE_PROJECT_ID }}
   CYPRESS_RECORD_KEY: ${{ secrets.EXAMPLE_RECORDING_KEY }}
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+permissions:
+  contents: read
+  actions: read
 
 jobs:
   check-record-key:

.github/workflows/example-start-and-pnpm-workspaces.yml

@@ -10,6 +10,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   # The example has pnpm workspaces in its "root" folder

.github/workflows/example-start-and-yarn-workspaces.yml

@@ -10,6 +10,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   single:

.github/workflows/example-start.yml

@@ -16,6 +16,8 @@ env:
   # works around issue when more than one instance of serve is started
   # See PR https://github.com/vercel/serve/pull/457
   NO_UPDATE_CHECK: 1
+permissions:
+  contents: read
 
 jobs:
   start:

.github/workflows/example-wait-on.yml

@@ -10,6 +10,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   wait:

.github/workflows/example-webpack.yml

@@ -5,6 +5,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   wait:

.github/workflows/example-yarn-classic.yml

@@ -10,6 +10,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   yarn-classic:

.github/workflows/example-yarn-modern-pnp.yml

@@ -5,6 +5,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   yarn-modern-pnp:

.github/workflows/example-yarn-modern.yml

@@ -5,6 +5,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   yarn-modern:

.github/workflows/main.yml

@@ -4,6 +4,8 @@ on:
     branches:
       - 'master'
   pull_request:
+permissions:
+  contents: read
 jobs:
   build-and-test:
     runs-on: ubuntu-24.04
@@ -28,6 +30,10 @@ jobs:
       - run: npm run format:all:check # Prettier formatting check
 
   release:
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
     runs-on: ubuntu-24.04
     name: release
     needs: [build-and-test]

.github/workflows/triage_closed_issue_comment.yml

@@ -3,6 +3,7 @@ on:
   issue_comment:
     types:
       - created
+permissions: {}
 jobs:
   closed-issue-comment:
     # skip in fork