From 563a12c738ef4b31f5a895ee37e481345180f9a3 Mon Sep 17 00:00:00 2001
From: Myles Scolnick <myles@marimo.io>
Date: Tue, 14 Jul 2026 16:44:58 -0400
Subject: [PATCH] ci: adopt deny-all top-level workflow permissions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Set each workflow's top-level `permissions:` to `{}` (deny-all) and move the
previously top-level grants into the specific jobs that inherited them.
Effective permissions are unchanged for every job — this makes the grants
explicit per job so a newly-added job can't silently inherit broad scopes.

Flagged by github-maintenance Workflow Permissions Audit.
---
 .github/workflows/demo.yml    | 5 +++--
 .github/workflows/release.yml | 7 +++++--
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/demo.yml b/.github/workflows/demo.yml
index b4f9a12..e968ad8 100644
--- a/.github/workflows/demo.yml
+++ b/.github/workflows/demo.yml
@@ -5,8 +5,7 @@ on:
     branches:
       - main
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   build:
@@ -38,6 +37,8 @@ jobs:
         uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
         with:
           path: './demo/dist'
+    permissions:
+      contents: read
 
   deploy:
     name: 🚀 Deploy
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0e13b9b..3f50b45 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,7 +1,6 @@
 name: Release
 
-permissions:
-  contents: read
+permissions: {}
 
 on:
   push:
@@ -73,6 +72,8 @@ jobs:
             LICENSE
           retention-days: 1
           if-no-files-found: error
+    permissions:
+      contents: read
 
   publish:
     needs: build
@@ -131,3 +132,5 @@ jobs:
           status: ${{ (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')) && 'failure' || 'success' }}
           slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL_RELEASES }}
           artifact-url: "https://npmjs.com/package/@marimo-team/codemirror-sql"
+    permissions:
+      contents: read