From 2dee7457cdcf55008fdeb8a569464a0bbf730284 Mon Sep 17 00:00:00 2001
From: Vishnu Narayanan <iamwishnu@gmail.com>
Date: Mon, 4 May 2026 17:56:25 +0530
Subject: [PATCH] fix: set minimal top-level permissions on workflows (#14358)

- Fix CodeQL alerts by declaring read-only GITHUB_TOKEN scope at the
workflow level. The codespace image publish workflow additionally needs
packages: write to push to ghcr.io.
---
 .github/workflows/deploy_check.yml             | 3 +++
 .github/workflows/frontend-fe.yml              | 3 +++
 .github/workflows/logging_percentage_check.yml | 3 +++
 .github/workflows/nightly_installer.yml        | 3 +++
 .github/workflows/publish_codespace_image.yml  | 4 ++++
 .github/workflows/publish_ee_docker.yml        | 3 +++
 .github/workflows/publish_foss_docker.yml      | 3 +++
 .github/workflows/size-limit.yml               | 3 +++
 .github/workflows/test_docker_build.yml        | 3 +++
 9 files changed, 28 insertions(+)

diff --git a/.github/workflows/deploy_check.yml b/.github/workflows/deploy_check.yml
index 9f295a6c8f0..9f2ae42d820 100644
--- a/.github/workflows/deploy_check.yml
+++ b/.github/workflows/deploy_check.yml
@@ -11,6 +11,9 @@ concurrency:
   group: pr-${{ github.workflow }}-${{ github.head_ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   deployment_check:
     name: Check Deployment
diff --git a/.github/workflows/frontend-fe.yml b/.github/workflows/frontend-fe.yml
index 1d1116d0c6f..3d992662a4b 100644
--- a/.github/workflows/frontend-fe.yml
+++ b/.github/workflows/frontend-fe.yml
@@ -8,6 +8,9 @@ on:
     branches:
       - develop
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-22.04
diff --git a/.github/workflows/logging_percentage_check.yml b/.github/workflows/logging_percentage_check.yml
index 5c45ba63519..cef07cc2fef 100644
--- a/.github/workflows/logging_percentage_check.yml
+++ b/.github/workflows/logging_percentage_check.yml
@@ -10,6 +10,9 @@ concurrency:
   group: pr-${{ github.workflow }}-${{ github.head_ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   log_lines_check:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/nightly_installer.yml b/.github/workflows/nightly_installer.yml
index beef5727c5e..e0c5ed88ebd 100644
--- a/.github/workflows/nightly_installer.yml
+++ b/.github/workflows/nightly_installer.yml
@@ -14,6 +14,9 @@ on:
     - cron: "0 0 * * *"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   nightly:
     runs-on: ubuntu-24.04
diff --git a/.github/workflows/publish_codespace_image.yml b/.github/workflows/publish_codespace_image.yml
index 5da4fda052f..c1b0e4e287e 100644
--- a/.github/workflows/publish_codespace_image.yml
+++ b/.github/workflows/publish_codespace_image.yml
@@ -3,6 +3,10 @@ name: Publish Codespace Base Image
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   publish-code-space-image:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/publish_ee_docker.yml b/.github/workflows/publish_ee_docker.yml
index 8e2c2248163..982054a18d8 100644
--- a/.github/workflows/publish_ee_docker.yml
+++ b/.github/workflows/publish_ee_docker.yml
@@ -18,6 +18,9 @@ on:
 env:
   DOCKER_REPO: chatwoot/chatwoot
 
+permissions:
+  contents: read
+
 jobs:
   build:
     strategy:
diff --git a/.github/workflows/publish_foss_docker.yml b/.github/workflows/publish_foss_docker.yml
index 3075a7f3d23..994e5cef8a1 100644
--- a/.github/workflows/publish_foss_docker.yml
+++ b/.github/workflows/publish_foss_docker.yml
@@ -18,6 +18,9 @@ on:
 env:
   DOCKER_REPO: chatwoot/chatwoot
 
+permissions:
+  contents: read
+
 jobs:
   build:
     strategy:
diff --git a/.github/workflows/size-limit.yml b/.github/workflows/size-limit.yml
index 7869bf89c0b..909636a75c0 100644
--- a/.github/workflows/size-limit.yml
+++ b/.github/workflows/size-limit.yml
@@ -10,6 +10,9 @@ concurrency:
   group: pr-${{ github.workflow }}-${{ github.head_ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-22.04
diff --git a/.github/workflows/test_docker_build.yml b/.github/workflows/test_docker_build.yml
index b27d90408a8..96a6c69ac5d 100644
--- a/.github/workflows/test_docker_build.yml
+++ b/.github/workflows/test_docker_build.yml
@@ -7,6 +7,9 @@ on:
       - master
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   test-build:
     strategy: