From d6775416936dd18cde6937d9405c4fc5181fe96b Mon Sep 17 00:00:00 2001
From: jrfnl <jrfnl@users.noreply.github.com>
Date: Sat, 15 Aug 2026 21:39:58 +0200
Subject: [PATCH] GH Actions: set permissions for each workflow/job

> Users frequently over-scope their workflow and job permissions, or set broad workflow-level permissions without realizing that all jobs inherit those permissions.
>
> Furthermore, users often don't realize that the _default_ `GITHUB_TOKEN` permissions can be very broad, meaning that workflows that don't configure any permissions at all can _still_ provide excessive credentials to their individual jobs.
>
> **Remediation**
> In general, permissions should be declared as minimally as possible, and as close to their usage site as possible.
>
> In practice, this means that workflows should almost always set `permissions: {}` at the workflow level to disable all permissions by default, and then set specific job-level permissions as needed.

Refs:
* https://docs.zizmor.sh/audits/#excessive-permissions
---
 .github/workflows/cs.yml   |  6 ++++++
 .github/workflows/test.yml | 15 ++++++++++++---
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/cs.yml b/.github/workflows/cs.yml
index acebd1d..bdea204 100644
--- a/.github/workflows/cs.yml
+++ b/.github/workflows/cs.yml
@@ -12,8 +12,14 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Permissions should be configured at the job level.
+permissions: {}
+
 jobs:
   checkcs:
+    permissions:
+      contents: read # To clone the repo.
+
     name: 'Check code style'
     runs-on: ubuntu-latest
 
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index cca170c..9713fed 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -12,9 +12,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Permissions should be configured at the job level.
+permissions: {}
+
 jobs:
   test:
-    runs-on: ubuntu-latest
+    permissions:
+      contents: read # To clone the repo.
 
     strategy:
       matrix:
@@ -40,9 +44,11 @@ jobs:
           - php: '8.6'
             experimental: true
 
-    name: "Test on PHP ${{ matrix.php }}"
     continue-on-error: ${{ matrix.experimental }}
 
+    name: "Test on PHP ${{ matrix.php }}"
+    runs-on: ubuntu-latest
+
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -97,8 +103,10 @@ jobs:
         run: composer phpunit10
 
   coverage:
+    permissions:
+      contents: read # To clone the repo.
+
     needs: test
-    runs-on: ubuntu-latest
 
     strategy:
       matrix:
@@ -106,6 +114,7 @@ jobs:
           - '7.4'
 
     name: "Coverage on PHP ${{ matrix.php }}"
+    runs-on: ubuntu-latest
 
     steps:
       - name: Checkout code