From 4fc18d4e1c4dcc19c30792ce20f60b85f5774a0f Mon Sep 17 00:00:00 2001
From: "patchback[bot]" <45432694+patchback[bot]@users.noreply.github.com>
Date: Sat, 15 Aug 2026 09:29:54 +0200
Subject: [PATCH] Harden actions. (#1308) (#1309)

(cherry picked from commit 6ae46db84595df99082726946ce6b12720dcd6a5)

Co-authored-by: Felix Fontein <felix@fontein.de>
---
 .github/workflows/docker-images.yml | 4 ++++
 .github/workflows/nox.yml           | 3 +++
 2 files changed, 7 insertions(+)

diff --git a/.github/workflows/docker-images.yml b/.github/workflows/docker-images.yml
index 4ab8bade..333d98e6 100644
--- a/.github/workflows/docker-images.yml
+++ b/.github/workflows/docker-images.yml
@@ -43,6 +43,10 @@ jobs:
             tag: check
             tag-as-latest: true
 
+    permissions:
+      contents: read
+      packages: write
+
     steps:
       - name: Check out repository
         uses: actions/checkout@v7
diff --git a/.github/workflows/nox.yml b/.github/workflows/nox.yml
index f115d7c2..5c85a904 100644
--- a/.github/workflows/nox.yml
+++ b/.github/workflows/nox.yml
@@ -15,6 +15,9 @@ name: nox
     - cron: '0 9 * * *'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   # Make sure there is at most one active run per PR, but do not cancel any non-PR runs
   group: ${{ github.workflow }}-${{ (github.head_ref && github.event.number) || github.run_id }}