From 7314175d25aee820057154912ec39da61b8c245b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciek=20Go=C5=82aszewski?=
 <maciej.golaszewski@canonical.com>
Date: Wed, 20 Nov 2024 13:24:48 +0100
Subject: [PATCH] Add permission token at topLevel in workflows (#816)

---
 .github/workflows/automatic-doc-checks.yml | 10 ++++++----
 .github/workflows/docs-spelling-checks.yml |  2 ++
 .github/workflows/sync-images.yaml         |  3 +++
 3 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/automatic-doc-checks.yml b/.github/workflows/automatic-doc-checks.yml
index 5472b1662..d3bba4576 100644
--- a/.github/workflows/automatic-doc-checks.yml
+++ b/.github/workflows/automatic-doc-checks.yml
@@ -3,13 +3,15 @@ name: Core Documentation Checks
 on:
   - workflow_dispatch
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
   documentation-checks:
-    uses: canonical/documentation-workflows/.github/workflows/documentation-checks.yaml@main
-    with:
-      working-directory: 'docs/moonray'
-      
+    - uses: canonical/documentation-workflows/.github/workflows/documentation-checks.yaml@main
+      with:
+        working-directory: 'docs/moonray'
diff --git a/.github/workflows/docs-spelling-checks.yml b/.github/workflows/docs-spelling-checks.yml
index d4f4f9da1..913ab75a8 100644
--- a/.github/workflows/docs-spelling-checks.yml
+++ b/.github/workflows/docs-spelling-checks.yml
@@ -5,6 +5,8 @@ on:
   # pull_request:
   #   paths:
   #     - 'docs/**'
+permissions:
+  contents: read
 
 jobs:
   spell-check:
diff --git a/.github/workflows/sync-images.yaml b/.github/workflows/sync-images.yaml
index 02b143a1b..2b3247844 100644
--- a/.github/workflows/sync-images.yaml
+++ b/.github/workflows/sync-images.yaml
@@ -3,6 +3,9 @@ name: Sync upstream images to ghcr.io
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   publish:
     runs-on: ubuntu-latest