From f73aa7f7ef1b04db77a9668501e1ec8b08a589d7 Mon Sep 17 00:00:00 2001
From: Maintenance <maintenance@users.noreply.github.com>
Date: Mon, 5 Oct 2026 23:58:27 -0700
Subject: [PATCH] ci: tighten workflow token permissions

---
 .github/workflows/audit.yml    | 4 +++-
 .github/workflows/ci.yml       | 3 +++
 .github/workflows/codeql.yml   | 6 ++++--
 .github/workflows/proof-pr.yml | 2 +-
 .github/workflows/pypi.yml     | 3 +++
 .github/workflows/release.yml  | 4 +++-
 6 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index ef8f455..dfd79b6 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -10,7 +10,6 @@ on:
 
 permissions:
   contents: read
-  issues: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -19,6 +18,9 @@ concurrency:
 jobs:
   audit:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 58cb70a..b128e5c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,6 +5,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 9f1b57a..adee62b 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -9,9 +9,7 @@ on:
     - cron: "23 9 * * 1"
 
 permissions:
-  actions: read
   contents: read
-  security-events: write
 
 concurrency:
   group: codeql-${{ github.ref }}
@@ -22,6 +20,10 @@ jobs:
     name: Analyze (${{ matrix.language }})
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
 
     strategy:
       fail-fast: false
diff --git a/.github/workflows/proof-pr.yml b/.github/workflows/proof-pr.yml
index cc3e795..bbbd396 100644
--- a/.github/workflows/proof-pr.yml
+++ b/.github/workflows/proof-pr.yml
@@ -9,7 +9,7 @@ permissions:
 
 jobs:
   proof:
-    uses: saagpatel/proof-pr/.github/workflows/proof-pr-receipt.yml@194f0864a1f17374d27bcc11e7d26a65bba2ffb3
+    uses: saagpatel/proof-pr/.github/workflows/proof-pr-receipt.yml@194f0864a1f17374d27bcc11e7d26a65bba2ffb3 # v0.2.14
     with:
       receipt_path: proof-pr.json
       proof_pr_ref: 194f0864a1f17374d27bcc11e7d26a65bba2ffb3
diff --git a/.github/workflows/pypi.yml b/.github/workflows/pypi.yml
index a2502fc..639041f 100644
--- a/.github/workflows/pypi.yml
+++ b/.github/workflows/pypi.yml
@@ -7,6 +7,9 @@ on:
         description: "Release tag to publish, for example v0.1.1"
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build distributions
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d8c7ca0..35736cf 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -6,12 +6,14 @@ on:
       - "v*"
 
 permissions:
-  contents: write  # required for softprops/action-gh-release
+  contents: read
 
 jobs:
   build-and-release:
     name: Build dist artifacts and create GitHub Release
     runs-on: ubuntu-latest
+    permissions:
+      contents: write  # required for softprops/action-gh-release
 
     steps:
       - name: Checkout