From a2ce8b04f31d921c1aef834dddf0b8548dc3411e Mon Sep 17 00:00:00 2001
From: Nick Craig-Wood <nick@craig-wood.com>
Date: Thu, 9 Apr 2026 14:37:30 +0100
Subject: [PATCH] build: add explicit permissions to GitHub Actions workflows

This restricts the GITHUB_TOKEN to least-privilege in all workflows,
fixing CodeQL code-scanning alerts for actions/missing-workflow-permissions.
---
 .github/workflows/build.yml                       | 3 +++
 .github/workflows/build_publish_docker_image.yml  | 4 ++++
 .github/workflows/build_publish_docker_plugin.yml | 3 +++
 .github/workflows/notify.yml                      | 3 +++
 .github/workflows/winget.yml                      | 3 +++
 5 files changed, 16 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 570f3f4da..bca29fcb2 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -19,6 +19,9 @@ on:
         type: boolean
         default: true
 
+permissions:
+  contents: read
+
 jobs:
   build:
     if: inputs.manual || (github.repository == 'rclone/rclone' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name))
diff --git a/.github/workflows/build_publish_docker_image.yml b/.github/workflows/build_publish_docker_image.yml
index 443bbe54e..3f9b6bc82 100644
--- a/.github/workflows/build_publish_docker_image.yml
+++ b/.github/workflows/build_publish_docker_image.yml
@@ -18,6 +18,10 @@ on:
         type: boolean
         default: true
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   build-image:
     if: inputs.manual || (github.repository == 'rclone/rclone' && github.event_name != 'pull_request')
diff --git a/.github/workflows/build_publish_docker_plugin.yml b/.github/workflows/build_publish_docker_plugin.yml
index f88d2f0f1..a1565857a 100644
--- a/.github/workflows/build_publish_docker_plugin.yml
+++ b/.github/workflows/build_publish_docker_plugin.yml
@@ -14,6 +14,9 @@ on:
         type: boolean
         default: true
 
+permissions:
+  contents: read
+
 jobs:
   build_docker_volume_plugin:
     if: inputs.manual || github.repository == 'rclone/rclone'
diff --git a/.github/workflows/notify.yml b/.github/workflows/notify.yml
index 5c5bfb49d..7580c6401 100644
--- a/.github/workflows/notify.yml
+++ b/.github/workflows/notify.yml
@@ -4,6 +4,9 @@ on:
   issues:
       types: [labeled]
 
+permissions:
+  contents: read
+
 jobs:
   notify:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/winget.yml b/.github/workflows/winget.yml
index 378e45a45..5b019c677 100644
--- a/.github/workflows/winget.yml
+++ b/.github/workflows/winget.yml
@@ -3,6 +3,9 @@ on:
   release:
     types: [released]
 
+permissions:
+  contents: read
+
 jobs:
   publish:
     runs-on: ubuntu-latest