From 6b8ce4aedf3e953624a442c02e8e7bf4d974d2b0 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <nca@infinisil.com>
Date: Sat, 26 Oct 2024 15:03:37 +0200
Subject: [PATCH] workflows: Fix security issues

read-all permissions gives access to e.g. security-events, which these
don't need, and can easily lead to leaks

Co-Authored-By: 13x1 <tori@disroot.org>
Co-Authored-By: basti564 <e3e@disroot.org>
---
 .github/workflows/codeowners.yml     | 3 +++
 .github/workflows/editorconfig.yml   | 4 +++-
 .github/workflows/manual-nixos.yml   | 3 ++-
 .github/workflows/manual-nixpkgs.yml | 3 ++-
 .github/workflows/nix-parse.yml      | 4 +++-
 5 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/codeowners.yml b/.github/workflows/codeowners.yml
index 1e2e5c9304ac..e210cacda14f 100644
--- a/.github/workflows/codeowners.yml
+++ b/.github/workflows/codeowners.yml
@@ -24,6 +24,9 @@ on:
   pull_request_target:
     types: [opened, ready_for_review, synchronize, reopened, edited]
 
+# We don't need any default GitHub token
+permissions: {}
+
 env:
   OWNERS_FILE: ci/OWNERS
   # Don't do anything on draft PRs
diff --git a/.github/workflows/editorconfig.yml b/.github/workflows/editorconfig.yml
index b4ef16a734b7..63264595bcc7 100644
--- a/.github/workflows/editorconfig.yml
+++ b/.github/workflows/editorconfig.yml
@@ -1,6 +1,8 @@
 name: "Checking EditorConfig"
 
-permissions: read-all
+permissions:
+  pull-requests: read
+  contents: read
 
 on:
   # avoids approving first time contributors
diff --git a/.github/workflows/manual-nixos.yml b/.github/workflows/manual-nixos.yml
index 2ae4d929c12d..eed27f5565ed 100644
--- a/.github/workflows/manual-nixos.yml
+++ b/.github/workflows/manual-nixos.yml
@@ -1,6 +1,7 @@
 name: "Build NixOS manual"
 
-permissions: read-all
+permissions:
+  contents: read
 
 on:
   pull_request_target:
diff --git a/.github/workflows/manual-nixpkgs.yml b/.github/workflows/manual-nixpkgs.yml
index 676a554107d5..14994e6c7542 100644
--- a/.github/workflows/manual-nixpkgs.yml
+++ b/.github/workflows/manual-nixpkgs.yml
@@ -1,6 +1,7 @@
 name: "Build Nixpkgs manual"
 
-permissions: read-all
+permissions:
+  contents: read
 
 on:
   pull_request_target:
diff --git a/.github/workflows/nix-parse.yml b/.github/workflows/nix-parse.yml
index 352cb81d87ed..d3991424617c 100644
--- a/.github/workflows/nix-parse.yml
+++ b/.github/workflows/nix-parse.yml
@@ -1,6 +1,8 @@
 name: "Check whether nix files are parseable"
 
-permissions: read-all
+permissions:
+  pull-requests: read
+  contents: read
 
 on:
   # avoids approving first time contributors