From 314dd317d2a46beb59f9a753e3b4afe4dfa9c128 Mon Sep 17 00:00:00 2001
From: Marian Steinbach <marian@giantswarm.io>
Date: Fri, 23 Jan 2026 16:03:10 +0100
Subject: [PATCH] Restrict default token permissions

---
 .github/workflows/chart-values.yaml            | 4 +++-
 .github/workflows/gitleaks.yaml                | 4 +++-
 .github/workflows/go-coverage.yaml             | 2 +-
 .github/workflows/issue-to-customer-board.yaml | 4 +---
 .github/workflows/validate-changelog.yaml      | 7 ++++---
 .github/workflows/validate-file-names.yaml     | 5 +++--
 .github/workflows/validate-workflows.yaml      | 4 +++-
 CHANGELOG.md                                   | 6 ++++++
 8 files changed, 24 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/chart-values.yaml b/.github/workflows/chart-values.yaml
index 5ba0b09..bf7a93b 100644
--- a/.github/workflows/chart-values.yaml
+++ b/.github/workflows/chart-values.yaml
@@ -3,11 +3,13 @@ name: Validate chart values and schema
 on:
   workflow_call: {}
 
-permissions: read-all
+permissions: {}
 
 jobs:
   validate:
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
diff --git a/.github/workflows/gitleaks.yaml b/.github/workflows/gitleaks.yaml
index 12443a8..3df74d9 100644
--- a/.github/workflows/gitleaks.yaml
+++ b/.github/workflows/gitleaks.yaml
@@ -3,11 +3,13 @@ name: Gitleaks
 on:
   workflow_call: {}
 
-permissions: read-all
+permissions: {}
 
 jobs:
   gitleaks:
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
diff --git a/.github/workflows/go-coverage.yaml b/.github/workflows/go-coverage.yaml
index 95a5335..86e2335 100644
--- a/.github/workflows/go-coverage.yaml
+++ b/.github/workflows/go-coverage.yaml
@@ -11,7 +11,7 @@ on:
       token:
         required: true
 
-permissions: read-all
+permissions: {}
 
 jobs:
   coverage:
diff --git a/.github/workflows/issue-to-customer-board.yaml b/.github/workflows/issue-to-customer-board.yaml
index a19a592..c048172 100644
--- a/.github/workflows/issue-to-customer-board.yaml
+++ b/.github/workflows/issue-to-customer-board.yaml
@@ -19,9 +19,7 @@ on:
       ISSUE_AUTOMATION:
         required: true
 
-permissions:
-  contents: read
-  issues: write
+permissions: {}
 
 env:
   BOARD_URL: https://github.com/orgs/giantswarm/projects/345
diff --git a/.github/workflows/validate-changelog.yaml b/.github/workflows/validate-changelog.yaml
index fcdee63..9af4966 100644
--- a/.github/workflows/validate-changelog.yaml
+++ b/.github/workflows/validate-changelog.yaml
@@ -3,14 +3,15 @@ name: Validate changelog
 on:
   workflow_call: {}
 
-permissions:
-  contents: read
-  pull-requests: write
+permissions: {}
 
 jobs:
   validate-changelog:
     name: Validate changelog structure
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      pull-requests: write
     if: contains(github.event.pull_request.head.ref, '#release#')
 
     steps:
diff --git a/.github/workflows/validate-file-names.yaml b/.github/workflows/validate-file-names.yaml
index 5c0d2b2..70c446f 100644
--- a/.github/workflows/validate-file-names.yaml
+++ b/.github/workflows/validate-file-names.yaml
@@ -5,13 +5,14 @@ on:
   workflow_call:
   workflow_dispatch:
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   validate:
     name: Validate file names
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout code
diff --git a/.github/workflows/validate-workflows.yaml b/.github/workflows/validate-workflows.yaml
index 5310b50..e427559 100644
--- a/.github/workflows/validate-workflows.yaml
+++ b/.github/workflows/validate-workflows.yaml
@@ -6,11 +6,13 @@ on:
       - '.github/workflows/*.yaml'
   workflow_dispatch: {}
 
-permissions: read-all
+permissions: {}
 
 jobs:
   validate:
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 37d3ca2..be2c952 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 however this project does not use Semantic Versioning and there are no releases.
 Instead this file uses a date-based structure.
 
+## 2026-01-23
+
+### Changed
+
+- Set restrictive default token permissions for `create-release-pr`, `fix-vulnerabilities`, `chart-values`, `gitleaks`, `go-coverage`, `issue-to-customer-board`, `validate-changelog`, `validate-file-names`, and `validate-workflows` workflows.
+
 ## 2026-01-16
 
 ### Changed