From 4f8bfbc262a9778d80f6183a13a03cbd68e78273 Mon Sep 17 00:00:00 2001
From: "hf-security-analysis[bot]"
 <265538906+hf-security-analysis[bot]@users.noreply.github.com>
Date: Wed, 23 Sep 2026 10:50:40 +0000
Subject: [PATCH] Scope GITHUB_TOKEN permissions per job

A job with no `permissions:` block inherits whatever the repository
hands out. Each block added here grants what that job's own steps
need and nothing more.
---
 .github/workflows/build-push-unity.yml | 5 +++++
 .github/workflows/pip.yml              | 4 ++++
 .github/workflows/quality.yml          | 4 ++++
 .github/workflows/tests-no-deps.yml    | 4 ++++
 .github/workflows/tests.yml            | 4 ++++
 .github/workflows/wheels.yml           | 7 +++++++
 6 files changed, 28 insertions(+)

diff --git a/.github/workflows/build-push-unity.yml b/.github/workflows/build-push-unity.yml
index 4b45db30..74df3173 100644
--- a/.github/workflows/build-push-unity.yml
+++ b/.github/workflows/build-push-unity.yml
@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   buildForAllSupportedPlatforms:
+    permissions:
+      contents: read
     name: Build ${{ matrix.targetPlatform }}
     runs-on: ubuntu-latest
     strategy:
@@ -84,6 +88,7 @@ jobs:
   #         path: ./builds/Standalone.tar.gz
 
   PushToHub:
+    permissions: {}
     name: Upload if release
     needs: [buildForAllSupportedPlatforms]
     runs-on: ubuntu-latest
diff --git a/.github/workflows/pip.yml b/.github/workflows/pip.yml
index a12139c6..5c98912d 100644
--- a/.github/workflows/pip.yml
+++ b/.github/workflows/pip.yml
@@ -11,8 +11,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index a513b4b5..b167f5a8 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -2,8 +2,12 @@ name: Quality Check
 
 on: [pull_request]
 
+permissions: {}
+
 jobs:
   quality:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v2
diff --git a/.github/workflows/tests-no-deps.yml b/.github/workflows/tests-no-deps.yml
index 24b3a743..e2cbd6b9 100644
--- a/.github/workflows/tests-no-deps.yml
+++ b/.github/workflows/tests-no-deps.yml
@@ -5,8 +5,12 @@ on: [pull_request]
 env:
   HF_HOME: ~/hf_cache
 
+permissions: {}
+
 jobs:
   run-tests:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
 
     strategy:
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 03a170dc..20b20dd2 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -5,8 +5,12 @@ on: [pull_request]
 env:
   HF_HOME: ~/hf_cache
 
+permissions: {}
+
 jobs:
   run-tests:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
 
     strategy:
diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml
index a12aa879..aae9345d 100644
--- a/.github/workflows/wheels.yml
+++ b/.github/workflows/wheels.yml
@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build_sdist:
+    permissions:
+      contents: read
     name: Build SDist
     runs-on: ubuntu-latest
     steps:
@@ -33,6 +37,8 @@ jobs:
 
 
   build_wheels:
+    permissions:
+      contents: read
     name: Wheels on ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
     strategy:
@@ -60,6 +66,7 @@ jobs:
 
 
   upload_all:
+    permissions: {}
     name: Upload if release
     needs: [build_wheels, build_sdist]
     runs-on: ubuntu-latest