From 830ad98c59215e4790eb076622494317b7ffbbe6 Mon Sep 17 00:00:00 2001
From: Marian Steinbach <marian@giantswarm.io>
Date: Fri, 4 Jul 2025 13:51:25 +0200
Subject: [PATCH 1/2] Set default permissions to read-all

---
 .github/workflows/chart-values.yaml       | 2 ++
 .github/workflows/gitleaks.yaml           | 2 ++
 .github/workflows/go-coverage.yaml        | 2 ++
 .github/workflows/publish-techdocs.yaml   | 2 ++
 .github/workflows/validate-workflows.yaml | 2 ++
 5 files changed, 10 insertions(+)

diff --git a/.github/workflows/chart-values.yaml b/.github/workflows/chart-values.yaml
index 143a85f..9cb5bdc 100644
--- a/.github/workflows/chart-values.yaml
+++ b/.github/workflows/chart-values.yaml
@@ -3,6 +3,8 @@ name: Validate chart values and schema
 on:
   workflow_call: {}
 
+permissions: read-all
+
 jobs:
   validate:
     runs-on: ubuntu-24.04
diff --git a/.github/workflows/gitleaks.yaml b/.github/workflows/gitleaks.yaml
index 3caad76..64c1078 100644
--- a/.github/workflows/gitleaks.yaml
+++ b/.github/workflows/gitleaks.yaml
@@ -3,6 +3,8 @@ name: Gitleaks
 on:
   workflow_call: {}
 
+permissions: read-all
+
 jobs:
   gitleaks:
     runs-on: ubuntu-24.04
diff --git a/.github/workflows/go-coverage.yaml b/.github/workflows/go-coverage.yaml
index 46f9a73..72eb467 100644
--- a/.github/workflows/go-coverage.yaml
+++ b/.github/workflows/go-coverage.yaml
@@ -11,6 +11,8 @@ on:
       token:
         required: true
 
+permissions: read-all
+
 jobs:
   coverage:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/publish-techdocs.yaml b/.github/workflows/publish-techdocs.yaml
index c875a42..b373c10 100644
--- a/.github/workflows/publish-techdocs.yaml
+++ b/.github/workflows/publish-techdocs.yaml
@@ -17,6 +17,8 @@ on:
       aws_secret_access_key:
         required: true
 
+permissions: read-all
+
 jobs:
   publish:
     if: github.event.repository.visibility == 'public'
diff --git a/.github/workflows/validate-workflows.yaml b/.github/workflows/validate-workflows.yaml
index 0a46383..d21e15f 100644
--- a/.github/workflows/validate-workflows.yaml
+++ b/.github/workflows/validate-workflows.yaml
@@ -6,6 +6,8 @@ on:
       - '.github/workflows/*.yaml'
   workflow_dispatch: {}
 
+permissions: read-all
+
 jobs:
   validate:
     runs-on: ubuntu-24.04

From bcf1a8469f11e8fc982a88a4a89c55f270fbb94f Mon Sep 17 00:00:00 2001
From: Marian Steinbach <marian@giantswarm.io>
Date: Fri, 4 Jul 2025 14:06:03 +0200
Subject: [PATCH 2/2] Set permissions for go-coverage workflow

---
 .github/workflows/go-coverage.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/go-coverage.yaml b/.github/workflows/go-coverage.yaml
index 72eb467..66761fa 100644
--- a/.github/workflows/go-coverage.yaml
+++ b/.github/workflows/go-coverage.yaml
@@ -16,6 +16,11 @@ permissions: read-all
 jobs:
   coverage:
     runs-on: ubuntu-latest
+    permissions:
+      # Needed to comment on the pull request
+      pull-requests: write
+      # Needed to create a comment on the commit
+      contents: write
     steps:
     - name: Clone repository
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2