Harden workflow permissions

.github/workflows/appimage.yml

@@ -48,6 +48,9 @@ on:
       - 'dist/linux/common/**'
       - 'dist/linux/resources/**'
 
+permissions:
+  contents: read
+
 env:
   JAVA_DIST: 'temurin'
   JAVA_VERSION: '26.0.1+8'

.github/workflows/aur-bin.yml

@@ -9,6 +9,9 @@ on:
         description: 'Source or Release tag'
         required: false
 
+permissions:
+  contents: read
+
 jobs:
   get-version:
     uses: ./.github/workflows/get-version.yml

.github/workflows/av-whitelist.yml

@@ -34,6 +34,8 @@ on:
         type: boolean
         default: false
 
+permissions: {}
+
 jobs:
   download-file:
     name: Downloads the file into the VM

.github/workflows/build.yml

@@ -17,6 +17,10 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   test:
     name: Compile and Test

.github/workflows/check-jdk-updates.yml

@@ -15,6 +15,8 @@ env:
       }
     }
 
+permissions: {}
+
 jobs:
   check-version:
     name: Checkout latest jdk version

.github/workflows/debian.yml

@@ -32,6 +32,9 @@ env:
   OPENJFX_JMODS_AARCH64: 'https://download2.gluonhq.com/openjfx/25.0.3/openjfx-25.0.3_linux-aarch64_bin-jmods.zip'
   OPENJFX_JMODS_AARCH64_HASH: 'e3fd682354346845d2944a2da2b1ff2b6cb9259d92027f2f9c121b9b93c5e42f'
 
+permissions:
+  contents: read
+
 jobs:
   get-version:
     uses: ./.github/workflows/get-version.yml

.github/workflows/dependency-check.yml

@@ -5,6 +5,9 @@ on:
   workflow_dispatch:
 
 
+permissions:
+  contents: read
+
 jobs:
   check-dependencies:
     uses: skymatic/workflows/.github/workflows/run-dependency-check.yml@8356563bf7b8d1c8d693f75ca487e8f57573cec9 # v3.1.0

.github/workflows/dl-stats.yml

@@ -4,6 +4,9 @@ on:
   schedule:
     - cron: '0/15 * * * *' # run every 15 min - don't forget to adjust the "interval" in the json sent to the metrics endpoint
 
+permissions:
+  contents: read
+
 jobs:
   report-download-stats:
     runs-on: ubuntu-latest

.github/workflows/draft-release.yml

@@ -13,6 +13,10 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   get-version:
     uses: ./.github/workflows/get-version.yml

.github/workflows/error-db.yml

@@ -6,6 +6,9 @@ on:
   discussion_comment:
     types: [created, edited, deleted]
 
+permissions:
+  discussions: read
+
 jobs:
   update-error-db:
     runs-on: ubuntu-latest

.github/workflows/get-version.yml

@@ -28,6 +28,9 @@ env:
   JAVA_DIST: 'temurin'
   JAVA_VERSION: 26
 
+permissions:
+  contents: read
+
 jobs:
   determine-version:
     name: 'Determines the version following semver'

.github/workflows/linux-flatpak.yml

@@ -23,6 +23,9 @@ on:
       - 'dist/linux/common/**'
       - 'dist/linux/resources/**'
 
+permissions:
+  contents: read
+
 jobs:
   get-version:
     uses: ./.github/workflows/get-version.yml

.github/workflows/linux-makepkg.yml

@@ -23,6 +23,9 @@ on:
       - 'dist/linux/common/**'
       - 'dist/linux/resources/**'
 
+permissions:
+  contents: read
+
 jobs:
   get-version:
     uses: ./.github/workflows/get-version.yml

.github/workflows/mac-dmg-x64.yml

@@ -62,6 +62,9 @@ env:
   VERSION_SUFFIX: ${{ inputs.semVerSuffix || ''}}
 
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build Cryptomator.app for ${{ matrix.output-suffix }}

.github/workflows/mac-dmg.yml

@@ -60,6 +60,9 @@ env:
   VERSION_SUFFIX: ${{ inputs.semVerSuffix || ''}}
 
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build Cryptomator.app for ${{ matrix.output-suffix }}

.github/workflows/post-publish.yml

@@ -4,6 +4,8 @@ on:
   release:
     types: [published]
 
+permissions: {}
+
 jobs:
   notify:
     runs-on: ubuntu-latest
@@ -142,4 +144,3 @@ jobs:
           token: ${{ secrets.CRYPTOBOT_WORKFLOW_DISPATCH_TOKEN }}
           repository: cryptomator/docs
           client-payload: '{ "version": "${{ github.event.release.tag_name }}", "release": ${{ toJson(github.event.release.assets) }} }'
-

.github/workflows/pullrequest.yml

@@ -11,6 +11,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 jobs: 
   test:
     name: Compile and Test

.github/workflows/release-check.yml

@@ -14,6 +14,9 @@ env:
   JAVA_DIST: 'temurin'
   JAVA_VERSION: 26
 
+permissions:
+  contents: read
+
 jobs:
   check-preconditions:
     name: Validate commits pushed to release/hotfix branch to fulfill release requirements

.github/workflows/win-exe.yml

@@ -71,6 +71,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 jobs:
   build-msi:
     name: Build .msi Installer

.github/workflows/winget.yml

@@ -7,6 +7,8 @@ on:
         description: 'Release tag'
         required: true
 
+permissions: {}
+
 jobs:
   winget:
     name: Publish winget package