From bc6f42d805add3eb8ecbfcf60417d85284a2296e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cl=C3=A9ment=20Robert?= <cr52@protonmail.com>
Date: Wed, 11 Mar 2026 20:45:38 +0100
Subject: [PATCH] SEC: disable default gha permissions (#2771)

---
 .github/workflows/release.yml             | 2 ++
 .github/workflows/test.yml                | 2 ++
 .github/workflows/update-dependencies.yml | 4 ++++
 3 files changed, 8 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b8a0ba66..2e8824a7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,6 +7,8 @@ on:
     types:
     - published
 
+permissions: {}
+
 jobs:
   dist:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 71c79eaf..1dd62034 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -28,6 +28,8 @@ on:
   workflow_dispatch:
     # allow manual runs on branches without a PR
 
+permissions: {}
+
 concurrency:
   group: test-${{ github.ref }}
   cancel-in-progress: true
diff --git a/.github/workflows/update-dependencies.yml b/.github/workflows/update-dependencies.yml
index 51bb5502..07200f5a 100644
--- a/.github/workflows/update-dependencies.yml
+++ b/.github/workflows/update-dependencies.yml
@@ -14,11 +14,15 @@ on:
   schedule:
     - cron: '0 6 * * 1'  # "At 06:00 on Monday."
 
+permissions: {}
+
 jobs:
   update-dependencies:
     name: Update dependencies
     if: github.repository_owner == 'pypa' || github.event_name != 'schedule'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
 
     # we use this step to grab a Github App auth token, so that PRs generated by this workflow