opentelemetrybot · Copilot · Aug 18, 2025 · Aug 18, 2025 · Aug 18, 2025
diff --git a/.github/workflows/base-binary-release.yaml b/.github/workflows/base-binary-release.yaml
@@ -17,6 +17,9 @@ on:
         default: ""
         description: "The collector dependency will be put into this folder"
 
+permissions:
+  contents: read
+
 env:
   # renovate: datasource=github-releases depName=goreleaser/goreleaser-pro
   GORELEASER_PRO_VERSION: v2.11.2

diff --git a/.github/workflows/base-ci-binary.yaml b/.github/workflows/base-ci-binary.yaml
@@ -18,6 +18,8 @@ on:
         default: ""
         description: "The collector dependency will be put into this folder"
 
+permissions:
+  contents: read
 
 env:
   # renovate: datasource=github-releases depName=goreleaser/goreleaser-pro

diff --git a/.github/workflows/base-ci-goreleaser.yaml b/.github/workflows/base-ci-goreleaser.yaml
@@ -28,6 +28,9 @@ on:
         required: false
         type: string
 
+permissions:
+  contents: read
+
 env:
   # renovate: datasource=github-releases depName=goreleaser/goreleaser-pro
   GORELEASER_PRO_VERSION: v2.11.2

diff --git a/.github/workflows/base-package-tests.yaml b/.github/workflows/base-package-tests.yaml
@@ -15,6 +15,9 @@ on:
         default: false
         description: "Set to true if a GH issue should be generated upon failure"
 
+permissions:
+  contents: read
+
 jobs:
   package-tests:
     name: Package Tests

diff --git a/.github/workflows/base-release.yaml b/.github/workflows/base-release.yaml
@@ -21,6 +21,9 @@ on:
         type: string
         default: false
 
+permissions:
+  contents: read
+
 env:
   # renovate: datasource=github-releases depName=goreleaser/goreleaser-pro
   GORELEASER_PRO_VERSION: v2.11.2

diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml
@@ -12,6 +12,9 @@ on:
       - main
       - release/*
 
+permissions:
+  contents: read
+
 env:
   # Make sure to exit early if cache segment download times out after 2 minutes.
   # We limit cache download as a whole to 5 minutes.

diff --git a/.github/workflows/ci-builder.yaml b/.github/workflows/ci-builder.yaml
@@ -27,6 +27,9 @@ on:
       - "go.mod"
       - "go.sum"
 
+permissions:
+  contents: read
+
 jobs:
   ci:
     uses: ./.github/workflows/base-ci-binary.yaml

diff --git a/.github/workflows/ci-goreleaser-contrib.yaml b/.github/workflows/ci-goreleaser-contrib.yaml
@@ -27,6 +27,9 @@ on:
       - "go.mod"
       - "go.sum"
 
+permissions:
+  contents: read
+
 jobs:
   check-goreleaser:
     name: CI - Contrib - GoReleaser

diff --git a/.github/workflows/ci-goreleaser-core.yaml b/.github/workflows/ci-goreleaser-core.yaml
@@ -27,6 +27,9 @@ on:
       - "go.mod"
       - "go.sum"
 
+permissions:
+  contents: read
+
 jobs:
   check-goreleaser:
     name: CI - Core - GoReleaser

diff --git a/.github/workflows/ci-goreleaser-ebpf-profiler.yaml b/.github/workflows/ci-goreleaser-ebpf-profiler.yaml
@@ -27,6 +27,9 @@ on:
       - "go.mod"
       - "go.sum"
 
+permissions:
+  contents: read
+
 jobs:
   check-goreleaser:
     name: CI - eBPF Profiler - GoReleaser

diff --git a/.github/workflows/ci-goreleaser-k8s.yaml b/.github/workflows/ci-goreleaser-k8s.yaml
@@ -27,6 +27,9 @@ on:
       - "go.mod"
       - "go.sum"
 
+permissions:
+  contents: read
+
 jobs:
   check-goreleaser:
     name: CI - k8s - GoReleaser

diff --git a/.github/workflows/ci-goreleaser-otlp.yaml b/.github/workflows/ci-goreleaser-otlp.yaml
@@ -27,6 +27,9 @@ on:
       - "go.mod"
       - "go.sum"
 
+permissions:
+  contents: read
+
 jobs:
   check-goreleaser:
     name: CI - OTLP - GoReleaser

diff --git a/.github/workflows/ci-opampsupervisor.yaml b/.github/workflows/ci-opampsupervisor.yaml
@@ -27,6 +27,9 @@ on:
       - "go.mod"
       - "go.sum"
 
+permissions:
+  contents: read
+
 jobs:
   ci:
     uses: ./.github/workflows/base-ci-binary.yaml

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -11,6 +11,9 @@ on:
       - main
       - release/*
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build

diff --git a/.github/workflows/msi-tests.yaml b/.github/workflows/msi-tests.yaml
@@ -10,6 +10,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   msi-tests:
     name: MSI Tests

diff --git a/.github/workflows/package-test.yaml b/.github/workflows/package-test.yaml
@@ -4,6 +4,9 @@ on:
   schedule:
     - cron: "0 2 * * *" # every day at 2am UTC
 
+permissions:
+  contents: read
+
 jobs:
   check-goreleaser:
     name: Build - Contrib - GoReleaser

diff --git a/.github/workflows/regression-tests.yaml b/.github/workflows/regression-tests.yaml
@@ -7,6 +7,9 @@ on:
       - main
       - release/*
 
+permissions:
+  contents: read
+
 jobs:
   check-goreleaser:
     name: Check docker token

diff --git a/.github/workflows/release-builder.yaml b/.github/workflows/release-builder.yaml
@@ -4,6 +4,9 @@ on:
   push:
     tags: ["v*"]
 
+permissions:
+  contents: read
+
 jobs:
   release:
     name: Release Builder

diff --git a/.github/workflows/release-contrib.yaml b/.github/workflows/release-contrib.yaml
@@ -4,6 +4,9 @@ on:
   push:
     tags: ["v*"]
 
+permissions:
+  contents: read
+
 jobs:
   release:
     name: Release Contrib

diff --git a/.github/workflows/release-core.yaml b/.github/workflows/release-core.yaml
@@ -4,6 +4,9 @@ on:
   push:
     tags: ["v*"]
 
+permissions:
+  contents: read
+
 jobs:
   release:
     name: Release Core

diff --git a/.github/workflows/release-k8s.yaml b/.github/workflows/release-k8s.yaml
@@ -4,6 +4,9 @@ on:
   push:
     tags: ["v*"]
 
+permissions:
+  contents: read
+
 jobs:
   release:
     name: Release k8s

diff --git a/.github/workflows/release-opampsupervisor.yaml b/.github/workflows/release-opampsupervisor.yaml
@@ -4,6 +4,9 @@ on:
   push:
     tags: ["v*"]
 
+permissions:
+  contents: read
+
 jobs:
   release:
     name: Release OpAMP supervisor

diff --git a/.github/workflows/release-otlp.yaml b/.github/workflows/release-otlp.yaml
@@ -4,6 +4,9 @@ on:
   push:
     tags: ["v*"]
 
+permissions:
+  contents: read
+
 jobs:
   release:
     name: Release OTLP

diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
@@ -10,6 +10,9 @@ on:
       - main
       - release/*
 
+permissions:
+  contents: read
+
 jobs:
   shellcheck:
     name: Shellcheck

diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
@@ -4,6 +4,9 @@ on:
   schedule:
     - cron: "12 5 * * *" # arbitrary time not to DDOS GitHub
 
+permissions:
+  contents: read
+
 jobs:
   stale:
     runs-on: ubuntu-24.04

diff --git a/.github/workflows/update-version.yaml b/.github/workflows/update-version.yaml
@@ -15,6 +15,9 @@ on:
         required: false
         default: ''
 
+permissions:
+  contents: read
+
 jobs:
   update-version:
     runs-on: ubuntu-24.04