From 63a970045a9b487e96af73d8954b23b00495c67f Mon Sep 17 00:00:00 2001
From: tooomm <tooomm@users.noreply.github.com>
Date: Sun, 23 Aug 2026 11:42:47 +0200
Subject: [PATCH] [CI] Minimal GitHub Actions permissions (#7165)

* add permission block

* add permissions block

* add permission block

* add permissions block

* switch order
---
 .github/workflows/codeql.yml              | 2 +-
 .github/workflows/desktop-lint.yml        | 3 +++
 .github/workflows/documentation-build.yml | 3 +++
 .github/workflows/translations-pull.yml   | 4 ++++
 .github/workflows/translations-push.yml   | 4 ++++
 5 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index fee0b34cb..58ca87573 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -9,8 +9,8 @@
 name: CodeQL
 
 permissions:
-  security-events: write    # needed to post results
   contents: read
+  security-events: write    # needed to post results
 
 on:
   push:
diff --git a/.github/workflows/desktop-lint.yml b/.github/workflows/desktop-lint.yml
index 5f31ea59c..93ba79464 100644
--- a/.github/workflows/desktop-lint.yml
+++ b/.github/workflows/desktop-lint.yml
@@ -1,5 +1,8 @@
 name: Code Style (C++) 
 
+permissions:
+  contents: read
+
 on:
   # Push trigger not needed for linting, we do not allow direct pushes to master
   pull_request:
diff --git a/.github/workflows/documentation-build.yml b/.github/workflows/documentation-build.yml
index 4c06f9ab3..419cbfbfb 100644
--- a/.github/workflows/documentation-build.yml
+++ b/.github/workflows/documentation-build.yml
@@ -1,5 +1,8 @@
 name: Generate Docs
 
+permissions:
+  contents: read    # write permission to the destination repo come from 'deploy_key'
+
 on:
   pull_request:
     paths:
diff --git a/.github/workflows/translations-pull.yml b/.github/workflows/translations-pull.yml
index a3db5f86d..71b0b4c22 100644
--- a/.github/workflows/translations-pull.yml
+++ b/.github/workflows/translations-pull.yml
@@ -1,5 +1,9 @@
 name: Update Translations
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   pull_request:
     paths:
diff --git a/.github/workflows/translations-push.yml b/.github/workflows/translations-push.yml
index c4d3f61fb..41a7aef40 100644
--- a/.github/workflows/translations-push.yml
+++ b/.github/workflows/translations-push.yml
@@ -1,5 +1,9 @@
 name: Update Translation Source
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   pull_request:
     paths: