zizmor: fix reusable workflow permissions

crazy-max · crazy-max · commit 48035b77437c · 2026-04-03T16:14:44.000+02:00
diff --git a/.github/workflows/.zizmor.yml b/.github/workflows/.zizmor.yml
@@ -4,8 +4,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
 permissions:
+  actions: read
   contents: read
 
 on:
@@ -19,6 +19,7 @@ jobs:
   run:
     uses: ./.github/workflows/zizmor.yml
     permissions:
+      actions: read
       contents: read
       security-events: write
     with:
diff --git a/.github/workflows/list-commits.yml b/.github/workflows/list-commits.yml
@@ -1,6 +1,5 @@
 name: list-commits
 
-# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
 permissions:
   contents: read
 
diff --git a/.github/workflows/pr-assign-author.yml b/.github/workflows/pr-assign-author.yml
@@ -1,6 +1,5 @@
 name: pr-assign-author
 
-# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
 permissions:
   contents: read
 
diff --git a/.github/workflows/releases-json.yml b/.github/workflows/releases-json.yml
@@ -1,6 +1,5 @@
 name: releases-json
 
-# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
 permissions:
   contents: read
 
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
@@ -1,7 +1,7 @@
 name: zizmor
 
-# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
 permissions:
+  actions: read
   contents: read
 
 on:
@@ -43,6 +43,7 @@ jobs:
   zizmor:
     runs-on: ubuntu-latest
     permissions:
+      actions: read
       contents: read
       security-events: write
     steps:
diff --git a/README.md b/README.md
@@ -254,6 +254,9 @@ they are skipped for `edge` resolution.
 ```yaml
 name: ci
 
+permissions:
+  contents: read
+
 on:
   push:
 
@@ -347,6 +350,7 @@ and uploads the SARIF report to GitHub code scanning.
 name: ci
 
 permissions:
+  actions: read
   contents: read
 
 on:
@@ -357,6 +361,7 @@ jobs:
   zizmor:
     uses: crazy-max/.github/.github/workflows/zizmor.yml@v1
     permissions:
+      actions: read
       contents: read
       security-events: write
     with:
