From 79d4dd48a7d4aa7ebcec7fda550c10e91b617ee4 Mon Sep 17 00:00:00 2001
From: Thibaud-Vdb <thibaud@getplumber.io>
Date: Wed, 5 Aug 2026 11:06:37 +0200
Subject: [PATCH] ci: declare least-privilege workflow permissions

Jobs without a permissions block inherit the repository default token
scope. Scopes are derived from what each workflow actually does with
the token:

- the fourteen package build and test workflows plus the code linter
  never write through the token, they drop to contents: read.
- lint-pr-title.yml gets pull-requests: read, which is what the
  semantic PR title action documents needing.
- comment-icon-preview.yml runs on workflow_run, a privileged trigger
  processing artifacts produced by fork PRs, so an exact scope matters
  most there: actions: read to download the artifact, issues: write
  plus pull-requests: write to post the preview comment, contents:
  read for the rest.

The workflows that already declared scoped permissions (labeler,
stale, linting-icons, release and friends) are untouched.
---
 .github/workflows/angular.yml              | 3 +++
 .github/workflows/comment-icon-preview.yml | 8 ++++++++
 .github/workflows/icons.yml                | 3 +++
 .github/workflows/lint-code.yml            | 3 +++
 .github/workflows/lint-pr-title.yml        | 4 ++++
 .github/workflows/lucide-astro.yml         | 3 +++
 .github/workflows/lucide-font.yml          | 3 +++
 .github/workflows/lucide-preact.yml        | 3 +++
 .github/workflows/lucide-react-native.yml  | 3 +++
 .github/workflows/lucide-react.yml         | 3 +++
 .github/workflows/lucide-shared.yml        | 3 +++
 .github/workflows/lucide-solid.yml         | 3 +++
 .github/workflows/lucide-static.yml        | 3 +++
 .github/workflows/lucide-svelte-5.yml      | 3 +++
 .github/workflows/lucide-vue.yml           | 3 +++
 .github/workflows/lucide.yml               | 3 +++
 16 files changed, 54 insertions(+)

diff --git a/.github/workflows/angular.yml b/.github/workflows/angular.yml
index cba7835f4..886e18a91 100644
--- a/.github/workflows/angular.yml
+++ b/.github/workflows/angular.yml
@@ -7,6 +7,9 @@ on:
       - tools/build-icons/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/comment-icon-preview.yml b/.github/workflows/comment-icon-preview.yml
index 91a72c376..f476a250a 100644
--- a/.github/workflows/comment-icon-preview.yml
+++ b/.github/workflows/comment-icon-preview.yml
@@ -6,6 +6,14 @@ on:
     types:
       - completed
 
+permissions:
+  contents: read
+  # Download the pr_number artifact from the triggering run.
+  actions: read
+  # Create or update the icon preview comment on the PR.
+  issues: write
+  pull-requests: write
+
 jobs:
   upload:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/icons.yml b/.github/workflows/icons.yml
index ac382be5e..538fe1339 100644
--- a/.github/workflows/icons.yml
+++ b/.github/workflows/icons.yml
@@ -9,6 +9,9 @@ on:
       - tools/rollup-plugins/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lint-code.yml b/.github/workflows/lint-code.yml
index ce7f23c0c..edb2915cb 100644
--- a/.github/workflows/lint-code.yml
+++ b/.github/workflows/lint-code.yml
@@ -3,6 +3,9 @@ name: Linting PR code
 on:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   lint-code:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lint-pr-title.yml b/.github/workflows/lint-pr-title.yml
index 32af252d4..0be3ac318 100644
--- a/.github/workflows/lint-pr-title.yml
+++ b/.github/workflows/lint-pr-title.yml
@@ -7,6 +7,10 @@ on:
       - edited
       - reopened
 
+permissions:
+  # The semantic PR action only reads the pull request title.
+  pull-requests: read
+
 jobs:
   lint-pr-title:
     name: PR Title Lint
diff --git a/.github/workflows/lucide-astro.yml b/.github/workflows/lucide-astro.yml
index d2a3ad6f6..bd27e26e5 100644
--- a/.github/workflows/lucide-astro.yml
+++ b/.github/workflows/lucide-astro.yml
@@ -11,6 +11,9 @@ on:
       - tools/build-icons/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lucide-font.yml b/.github/workflows/lucide-font.yml
index 490d07883..d6358a774 100644
--- a/.github/workflows/lucide-font.yml
+++ b/.github/workflows/lucide-font.yml
@@ -9,6 +9,9 @@ on:
       - tools/build-font/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   lucide-font:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lucide-preact.yml b/.github/workflows/lucide-preact.yml
index 43d58256f..a44092cd6 100644
--- a/.github/workflows/lucide-preact.yml
+++ b/.github/workflows/lucide-preact.yml
@@ -12,6 +12,9 @@ on:
       - tools/rollup-plugins/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   lucide-preact:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lucide-react-native.yml b/.github/workflows/lucide-react-native.yml
index 3db77b624..1430dffb6 100644
--- a/.github/workflows/lucide-react-native.yml
+++ b/.github/workflows/lucide-react-native.yml
@@ -12,6 +12,9 @@ on:
       - tools/rollup-plugins/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lucide-react.yml b/.github/workflows/lucide-react.yml
index ed89e1a36..165c2c3c8 100644
--- a/.github/workflows/lucide-react.yml
+++ b/.github/workflows/lucide-react.yml
@@ -13,6 +13,9 @@ on:
       - scripts/generateNextJSAliases.mjs
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lucide-shared.yml b/.github/workflows/lucide-shared.yml
index 9a07f4ee0..2538582db 100644
--- a/.github/workflows/lucide-shared.yml
+++ b/.github/workflows/lucide-shared.yml
@@ -9,6 +9,9 @@ on:
       - packages/shared/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lucide-solid.yml b/.github/workflows/lucide-solid.yml
index b31cf0486..5c1d99879 100644
--- a/.github/workflows/lucide-solid.yml
+++ b/.github/workflows/lucide-solid.yml
@@ -12,6 +12,9 @@ on:
       - tools/rollup-plugins/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lucide-static.yml b/.github/workflows/lucide-static.yml
index 224491d82..3ae78b031 100644
--- a/.github/workflows/lucide-static.yml
+++ b/.github/workflows/lucide-static.yml
@@ -7,6 +7,9 @@ on:
       - tools/build-icons/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   lucide-static:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lucide-svelte-5.yml b/.github/workflows/lucide-svelte-5.yml
index 7e828c9d9..c82888e05 100644
--- a/.github/workflows/lucide-svelte-5.yml
+++ b/.github/workflows/lucide-svelte-5.yml
@@ -12,6 +12,9 @@ on:
       - tools/rollup-plugins/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lucide-vue.yml b/.github/workflows/lucide-vue.yml
index a80cddf18..a998ffd1a 100644
--- a/.github/workflows/lucide-vue.yml
+++ b/.github/workflows/lucide-vue.yml
@@ -12,6 +12,9 @@ on:
       - tools/rollup-plugins/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lucide.yml b/.github/workflows/lucide.yml
index 91ab79166..3ac44fff1 100644
--- a/.github/workflows/lucide.yml
+++ b/.github/workflows/lucide.yml
@@ -11,6 +11,9 @@ on:
       - tools/rollup-plugins/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest