From 8186b901275d94a18286afd79ed3328f61342be6 Mon Sep 17 00:00:00 2001
From: Alex <aleksandrosansan@gmail.com>
Date: Thu, 3 Nov 2022 19:45:49 +0200
Subject: [PATCH 1/4] build: harden trivy.yml permissions

Signed-off-by: Alex <aleksandrosansan@gmail.com>
---
 .github/workflows/trivy.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
index 0c8766e0b..08bb97159 100644
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@@ -1,6 +1,10 @@
 name: trivy vulnerability scanner
 on:
   push:
+
+permissions:
+  contents: read  #  to fetch code (actions/checkout)
+
 jobs:
   build:
     name: Build

From 112cdf8b5aa24538a10e473ee2c9963da7931d24 Mon Sep 17 00:00:00 2001
From: Alex <aleksandrosansan@gmail.com>
Date: Thu, 3 Nov 2022 19:47:29 +0200
Subject: [PATCH 2/4] build: harden release-chart.yaml permissions

Signed-off-by: Alex <aleksandrosansan@gmail.com>
---
 .github/workflows/release-chart.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/release-chart.yaml b/.github/workflows/release-chart.yaml
index e87909178..21c29e1df 100644
--- a/.github/workflows/release-chart.yaml
+++ b/.github/workflows/release-chart.yaml
@@ -7,8 +7,13 @@ on:
     paths:
       - "charts/external-dns/Chart.yaml"
 
+permissions: {}
 jobs:
   release:
+
+    permissions:
+      contents: write  #  to push chart release and create a release (helm/chart-releaser-action)
+
     if: github.repository == 'kubernetes-sigs/external-dns'
     runs-on: ubuntu-latest
     defaults:

From 24480cf88972ff549778b2d4bb56d752c611cd69 Mon Sep 17 00:00:00 2001
From: Alex <aleksandrosansan@gmail.com>
Date: Thu, 3 Nov 2022 19:52:26 +0200
Subject: [PATCH 3/4] build: harden docs.yml permissions

Signed-off-by: Alex <aleksandrosansan@gmail.com>
---
 .github/workflows/docs.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index cfc08b081..f21f176d5 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -5,8 +5,12 @@ on:
     tags:
       - "v*"
 
+permissions: {}
 jobs:
   release_docs:
+    permissions:
+      contents: write  #  for mike to push
+
     name: Release Docs
     runs-on: ubuntu-latest
     steps:

From 41aaea8adf8bb3e4d3bb3ca0d2e2725747918988 Mon Sep 17 00:00:00 2001
From: Alex <aleksandrosansan@gmail.com>
Date: Thu, 3 Nov 2022 19:53:27 +0200
Subject: [PATCH 4/4] build: harden ci.yml permissions

Signed-off-by: Alex <aleksandrosansan@gmail.com>
---
 .github/workflows/ci.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 49b563348..5b2cc0e6d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,9 +6,16 @@ on:
   pull_request:
     branches: [ master ]
 
+permissions:
+  contents: read  #  to fetch code (actions/checkout)
+
 jobs:
 
   build:
+    permissions:
+      contents: read  #  to fetch code (actions/checkout)
+      checks: write  #  to create a new check based on the results (shogo82148/actions-goveralls)
+
     name: Build
     runs-on: ubuntu-latest
     steps: