From 6afd2f65df8eff1d7a53868614b425d8eb2fcf1a Mon Sep 17 00:00:00 2001
From: John Bampton <jbampton@gmail.com>
Date: Fri, 6 Jun 2025 08:18:37 +1000
Subject: [PATCH] [CI] gha: set default workflow permissions

---
 .github/workflows/docs.yml              | 3 +++
 .github/workflows/first-interaction.yml | 3 +++
 .github/workflows/pyflink.yml           | 3 +++
 .github/workflows/python-wheel.yml      | 3 +++
 .github/workflows/r.yml                 | 3 +++
 5 files changed, 15 insertions(+)

diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index ef6fd8b9a24..f9ca1bc7db9 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -26,6 +26,9 @@ on:
     branches:
       - '*'
 
+permissions:
+  contents: read
+
 env:
   MAVEN_OPTS: -Dmaven.wagon.httpconnectionManager.ttlSeconds=60
 
diff --git a/.github/workflows/first-interaction.yml b/.github/workflows/first-interaction.yml
index ef8dcd6da99..d23ecd7107e 100644
--- a/.github/workflows/first-interaction.yml
+++ b/.github/workflows/first-interaction.yml
@@ -23,6 +23,9 @@ on:
   pull_request:
     types: [opened]
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
diff --git a/.github/workflows/pyflink.yml b/.github/workflows/pyflink.yml
index 572fec4051c..2d4d1035743 100644
--- a/.github/workflows/pyflink.yml
+++ b/.github/workflows/pyflink.yml
@@ -39,6 +39,9 @@ on:
       - 'python/**'
       - '.github/workflows/pyflink.yml'
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
diff --git a/.github/workflows/python-wheel.yml b/.github/workflows/python-wheel.yml
index c0ccc0db676..850b0e11cd8 100644
--- a/.github/workflows/python-wheel.yml
+++ b/.github/workflows/python-wheel.yml
@@ -39,6 +39,9 @@ on:
       - 'python/**'
       - '.github/workflows/python-wheel.yml'
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
diff --git a/.github/workflows/r.yml b/.github/workflows/r.yml
index 55951c4036c..d57ebd0968f 100644
--- a/.github/workflows/r.yml
+++ b/.github/workflows/r.yml
@@ -39,6 +39,9 @@ on:
       - 'R/**'
       - '.github/workflows/r.yml'
 
+permissions:
+  contents: read
+
 env:
   MAVEN_OPTS: -Dmaven.wagon.httpconnectionManager.ttlSeconds=60
   DO_NOT_TRACK: true