[StepSecurity] ci: Harden GitHub Actions (#27202)

step-security-bot · web-flow · commit 601f0167e0a5 · 2026-04-07T20:29:52.000Z
Signed-off-by: StepSecurity Bot &lt;bot@stepsecurity.io&gt;
diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
@@ -10,6 +10,9 @@ on:
     paths:
       - ".github/workflows/copilot-setup-steps.yml"
 
+permissions:
+  contents: read
+
 jobs:
   # The job MUST be called `copilot-setup-steps` or it will not be picked up by Copilot.
   # See https://docs.github.com/en/copilot/customizing-copilot/customizing-the-development-environment-for-copilot-coding-agent
diff --git a/.github/workflows/windows-packaging-reusable.yml b/.github/workflows/windows-packaging-reusable.yml
@@ -13,6 +13,9 @@ env:
   SYSTEM_ARTIFACTSDIRECTORY: ${{ github.workspace }}/artifacts
   BUILD_ARTIFACTSTAGINGDIRECTORY: ${{ github.workspace }}/artifacts
 
+permissions:
+  contents: read
+
 jobs:
   package:
     name: ${{ matrix.architecture }} - ${{ matrix.channel }}
diff --git a/.github/workflows/xunit-tests.yml b/.github/workflows/xunit-tests.yml
@@ -14,6 +14,9 @@ on:
         required: false
         default: testResults-xunit
 
+permissions:
+  contents: read
+
 jobs:
   xunit:
     name: Run xUnit Tests
