From 1712d31a5c7e9718831cdc212c43a236e822aebd Mon Sep 17 00:00:00 2001
From: Tobias Hagemann <tobias.hagemann@skymatic.de>
Date: Tue, 15 Sep 2026 21:26:02 +0200
Subject: [PATCH] Scope draft release permissions

---
 .github/workflows/draft-release.yml | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/draft-release.yml b/.github/workflows/draft-release.yml
index e8b205552..68d1f72df 100644
--- a/.github/workflows/draft-release.yml
+++ b/.github/workflows/draft-release.yml
@@ -13,13 +13,11 @@ defaults:
   run:
     shell: bash
 
-permissions:
-  contents: read
-  pull-requests: read
-
 jobs:
   get-version:
     uses: ./.github/workflows/get-version.yml
+    permissions:
+      contents: read
     with:
       version:  ''
 
@@ -27,6 +25,9 @@ jobs:
     name: Compile and Test
     runs-on: ubuntu-latest
     needs: get-version
+    permissions:
+      contents: read
+      pull-requests: read
     if: needs.get-version.outputs.versionType != 'unknown'
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -75,6 +76,8 @@ jobs:
   build-exe-and-msi:
     needs: [get-version, create-release-draft]
     uses: ./.github/workflows/win-exe.yml
+    permissions:
+      contents: read
     with:
       semVerNum: ${{needs.get-version.outputs.semVerNum}}
       revisionNum: ${{needs.get-version.outputs.revNum}}
@@ -84,6 +87,8 @@ jobs:
   build-dmg-arm64:
     needs: [get-version, create-release-draft]
     uses: ./.github/workflows/mac-dmg.yml
+    permissions:
+      contents: read
     with:
       semVerNum: ${{needs.get-version.outputs.semVerNum}}
       revisionNum: ${{needs.get-version.outputs.revNum}}
@@ -93,6 +98,8 @@ jobs:
   build-dmg-x64:
     needs: [get-version, create-release-draft]
     uses: ./.github/workflows/mac-dmg-x64.yml
+    permissions:
+      contents: read
     with:
       semVerNum: ${{needs.get-version.outputs.semVerNum}}
       revisionNum: ${{needs.get-version.outputs.revNum}}
@@ -102,6 +109,8 @@ jobs:
   build-appimages:
     needs: [get-version, create-release-draft]
     uses: ./.github/workflows/appimage.yml
+    permissions:
+      contents: read
     with:
       semVerNum: ${{needs.get-version.outputs.semVerNum}}
       revisionNum: ${{needs.get-version.outputs.revNum}}
@@ -111,6 +120,8 @@ jobs:
   update-sha256sums:
     runs-on: ubuntu-latest
     needs: [get-version, build-exe-and-msi, build-dmg-arm64, build-dmg-x64, build-appimages]
+    permissions:
+      contents: read
     env:
       TAG: ${{ github.ref_name }}
       SEMVER: ${{ needs.get-version.outputs.semVerStr }}