From 55d4fc8f91bba03d9b6785df277a4d8e04527fcc Mon Sep 17 00:00:00 2001
From: Rylie Pavlik <rylie.pavlik@collabora.com>
Date: Mon, 6 Jul 2026 16:56:40 -0500
Subject: [PATCH 1/5] ci: Initial github actions cleanups per zizmor

---
 .github/workflows/android.yml                 | 12 +++++++++++-
 .../check_clang_format_and_codespell.yml      |  5 +++++
 .github/workflows/macOS.yml                   |  4 ++++
 .github/workflows/macos-build.yml             |  8 +++++++-
 .github/workflows/msvc-build-preset.yml       | 19 +++++++++++++++----
 .github/workflows/pr.yml                      |  4 +++-
 .github/workflows/release.yml                 |  4 +++-
 .github/workflows/snapshot.yml                |  4 +++-
 .github/workflows/windows-matrix.yml          | 10 +++++++++-
 9 files changed, 60 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index 3426dfb4d..61efa4d8f 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -1,4 +1,4 @@
-# Copyright 2021-2025, Collabora, Ltd.
+# Copyright 2021-2026, Collabora, Ltd.
 # SPDX-License-Identifier: CC0-1.0
 
 name: Android
@@ -18,12 +18,18 @@ on:
         description: "Should we make a debug configured build?"
         default: true
 
+permissions: {}
+
 jobs:
   # Loader
   loader:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Get modern CMake and Ninja
         uses: "lukka/get-cmake@v4.2.3"
 
@@ -44,8 +50,12 @@ jobs:
   # Hello XR
   build-helloxr:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: "actions/checkout@v7"
+        with:
+          persist-credentials: false
       - name: "Get modern CMake and Ninja"
         uses: "lukka/get-cmake@v4.2.3"
       - name: "set up JDK"
diff --git a/.github/workflows/check_clang_format_and_codespell.yml b/.github/workflows/check_clang_format_and_codespell.yml
index 84804564d..8987eb92b 100644
--- a/.github/workflows/check_clang_format_and_codespell.yml
+++ b/.github/workflows/check_clang_format_and_codespell.yml
@@ -6,16 +6,21 @@ name: Check code formatting and spelling
 on:
   workflow_call:
 
+permissions: {}
+
 jobs:
   clang-format:
     runs-on: ubuntu-latest
     container:
       image: khronosgroup/docker-images:openxr.20260415@sha256:800fd68bd1b16b426555158f4aa06b2ef1c150fba922d7a11361fc85f6ba0bcd
 
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v7
         with:
           lfs: true
+          persist-credentials: false
 
       - run: ./runClangFormat.sh
         name: Run clang-format
diff --git a/.github/workflows/macOS.yml b/.github/workflows/macOS.yml
index 57f1be811..1522980c6 100644
--- a/.github/workflows/macOS.yml
+++ b/.github/workflows/macOS.yml
@@ -23,8 +23,12 @@ jobs:
           ]
     runs-on: ${{ matrix.device }}
 
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: "Get modern CMake and Ninja"
         uses: "lukka/get-cmake@v4.2.3"
       - name: Prepare Vulkan SDK
diff --git a/.github/workflows/macos-build.yml b/.github/workflows/macos-build.yml
index 690463968..2e02bde65 100644
--- a/.github/workflows/macos-build.yml
+++ b/.github/workflows/macos-build.yml
@@ -1,4 +1,4 @@
-# Copyright 2021-2025, Collabora, Ltd.
+# Copyright 2021-2026, Collabora, Ltd.
 # SPDX-License-Identifier: CC0-1.0
 
 name: macOS builds
@@ -6,14 +6,20 @@ on:
   workflow_call:
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   macos-build:
     name: macOS build
     runs-on: macos-latest
 
+    permissions:
+      contents: read
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Install Dependencies
         run: |
diff --git a/.github/workflows/msvc-build-preset.yml b/.github/workflows/msvc-build-preset.yml
index 6b761a99d..f68d4dd7d 100644
--- a/.github/workflows/msvc-build-preset.yml
+++ b/.github/workflows/msvc-build-preset.yml
@@ -1,4 +1,4 @@
-# Copyright 2021-2025, Collabora, Ltd.
+# Copyright 2021-2026, Collabora, Ltd.
 # SPDX-License-Identifier: CC0-1.0
 
 on:
@@ -22,8 +22,12 @@ on:
         type: string
         default: install
 
+permissions: {}
+
 jobs:
   msvc-build:
+    permissions:
+      contents: read
     runs-on: windows-latest
     env:
       VULKAN_SDK_VERSION: "1.1.114.0"
@@ -34,6 +38,7 @@ jobs:
           lfs: true
           fetch-tags: "${{ !github.event.release }}"
           fetch-depth: "${{ github.event.release && '0' || '1'}}"
+          persist-credentials: false
 
       - name: Get modern CMake and Ninja
         uses: lukka/get-cmake@v4.2.3
@@ -51,12 +56,18 @@ jobs:
         shell: pwsh
         run: |
           Copy-Item .github/scripts/CMakePresets.json .
-          cmake --fresh --preset ${{ inputs.preset }} -S . -B $env:RUNNER_TEMP
+          cmake --fresh --preset $env:INPUTS_PRESET -S . -B $env:RUNNER_TEMP
+        env:
+          INPUTS_PRESET: ${{ inputs.preset }}
       - name: Build
-        run: "cmake --build $env:RUNNER_TEMP --parallel --clean-first --config ${{ inputs.buildType }}"
+        run: "cmake --build $env:RUNNER_TEMP --parallel --clean-first --config $env:INPUTS_BUILDTYPE"
+        env:
+          INPUTS_BUILDTYPE: ${{ inputs.buildType }}
 
       - name: Install
-        run: "cmake --build $env:RUNNER_TEMP --parallel --config ${{ inputs.buildType }} --target install"
+        run: "cmake --build $env:RUNNER_TEMP --parallel --config $env:INPUTS_BUILDTYPE --target install"
+        env:
+          INPUTS_BUILDTYPE: ${{ inputs.buildType }}
 
       - name: Upload Artifacts
         uses: actions/upload-artifact@v7
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index f0947ca59..1556e817b 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -1,10 +1,12 @@
-# Copyright 2021-2022, Collabora, Ltd.
+# Copyright 2021-2026, Collabora, Ltd.
 # SPDX-License-Identifier: CC0-1.0
 
 name: Pull request checks
 on:
   pull_request:
 
+permissions: {}
+
 jobs:
   msvc-build:
     uses: ./.github/workflows/windows-matrix.yml
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 510652ed7..073497994 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,4 +1,4 @@
-# Copyright 2021-2025, Collabora, Ltd.
+# Copyright 2021-2026, Collabora, Ltd.
 # SPDX-License-Identifier: CC0-1.0
 
 name: Build release artifacts
@@ -7,6 +7,8 @@ on:
     types: [published]
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   # Currently Android artifacts are generated and signed internally before publication to GitHub.
   # android:
diff --git a/.github/workflows/snapshot.yml b/.github/workflows/snapshot.yml
index 3f2c5483c..87fae9c3f 100644
--- a/.github/workflows/snapshot.yml
+++ b/.github/workflows/snapshot.yml
@@ -1,10 +1,12 @@
-# Copyright 2021, Collabora, Ltd.
+# Copyright 2021-2026, Collabora, Ltd.
 # SPDX-License-Identifier: CC0-1.0
 
 name: Android Builds - Publish Snapshot
 on:
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   android:
     uses: ./.github/workflows/android.yml
diff --git a/.github/workflows/windows-matrix.yml b/.github/workflows/windows-matrix.yml
index d7924887b..3335f390c 100644
--- a/.github/workflows/windows-matrix.yml
+++ b/.github/workflows/windows-matrix.yml
@@ -1,4 +1,4 @@
-# Copyright 2021-2023, Collabora, Ltd.
+# Copyright 2021-2026, Collabora, Ltd.
 # SPDX-License-Identifier: CC0-1.0
 
 name: Windows builds
@@ -11,6 +11,8 @@ on:
         default: false
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   # generate_matrix:
   #   runs-on: ubuntu-latest
@@ -22,6 +24,8 @@ jobs:
   #       run: "python3 .github/scripts/generate_windows_matrix_build.py matrix"
   msvc-build:
     # needs: generate_matrix
+    permissions:
+      contents: read
     strategy:
       fail-fast: true
       # TODO: Fix matrix generation? Broke recently due to changes in github actions
@@ -46,8 +50,12 @@ jobs:
     needs:
       - msvc-build
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
     steps:
       - uses: "actions/checkout@v7"
+        with:
+          persist-credentials: false
 
       - name: Retrieve artifacts
         uses: "actions/download-artifact@v8"

From 69ccef9e5119571aea62751d517a2ae5547d1780 Mon Sep 17 00:00:00 2001
From: Rylie Pavlik <rylie.pavlik@collabora.com>
Date: Mon, 6 Jul 2026 17:09:39 -0500
Subject: [PATCH 2/5] ci: Pin actions to hash

---
 .github/workflows/android.yml                    | 16 ++++++++--------
 .../check_clang_format_and_codespell.yml         |  4 ++--
 .github/workflows/macOS.yml                      |  6 +++---
 .github/workflows/macos-build.yml                |  4 ++--
 .github/workflows/msvc-build-preset.yml          |  8 ++++----
 .github/workflows/windows-matrix.yml             | 12 ++++++------
 6 files changed, 25 insertions(+), 25 deletions(-)

diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index 61efa4d8f..c7c9bb6f3 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -27,11 +27,11 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # actions/checkout@v7
         with:
           persist-credentials: false
       - name: Get modern CMake and Ninja
-        uses: "lukka/get-cmake@v4.2.3"
+        uses: "lukka/get-cmake@f176ccd3f28bda569c43aae4894f06b2435a3375" # lukka/get-cmake@v4.2.3
 
       # Do this before building aar since it affects the version
       - name: Touch SNAPSHOT marker file
@@ -42,7 +42,7 @@ jobs:
         run: "./maintainer-scripts/build-aar.sh"
 
       - name: Upload bare AAR
-        uses: "actions/upload-artifact@v7"
+        uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # actions/upload-artifact@v7
         with:
           name: AAR and POM
           path: openxr_loader_for_android*
@@ -53,18 +53,18 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: "actions/checkout@v7"
+      - uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # actions/checkout@v7
         with:
           persist-credentials: false
       - name: "Get modern CMake and Ninja"
-        uses: "lukka/get-cmake@v4.2.3"
+        uses: "lukka/get-cmake@f176ccd3f28bda569c43aae4894f06b2435a3375" # lukka/get-cmake@v4.2.3
       - name: "set up JDK"
-        uses: "actions/setup-java@v5"
+        uses: "actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520" # actions/setup-java@v5
         with:
           java-version-file: ".github/.java-version"
           distribution: "temurin"
       # Also performs Gradle wrapper validation
-      - uses: "gradle/actions/setup-gradle@v5"
+      - uses: "gradle/actions/setup-gradle@6f229686ee4375cc4a86b2514c89bac4930e82c4" # gradle/actions/setup-gradle@v5
 
       # HelloXR OpenGLES version
       - name: Build HelloXR OpenGLES for Android
@@ -72,7 +72,7 @@ jobs:
 
       - name: Upload HelloXR OpenGLES (debug) for Android
         if: "!inputs.release"
-        uses: "actions/upload-artifact@v7"
+        uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # actions/upload-artifact@v7
         with:
           name: HelloXR OpenGLES Android
           path: "src/tests/hello_xr/build/outputs/apk/OpenGLES/debug/*.apk"
diff --git a/.github/workflows/check_clang_format_and_codespell.yml b/.github/workflows/check_clang_format_and_codespell.yml
index 8987eb92b..42ec23a3d 100644
--- a/.github/workflows/check_clang_format_and_codespell.yml
+++ b/.github/workflows/check_clang_format_and_codespell.yml
@@ -17,7 +17,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # actions/checkout@v7
         with:
           lfs: true
           persist-credentials: false
@@ -33,7 +33,7 @@ jobs:
         if: ${{ failure() }}
       - name: Publish diff
         if: ${{ failure() }}
-        uses: actions/upload-artifact@v7
+        uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # actions/upload-artifact@v7
         with:
           path: ${{ runner.temp }}/clang-format.patch
           name: clang-format-changes
diff --git a/.github/workflows/macOS.yml b/.github/workflows/macOS.yml
index 1522980c6..8d32a7bd9 100644
--- a/.github/workflows/macOS.yml
+++ b/.github/workflows/macOS.yml
@@ -26,13 +26,13 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # actions/checkout@v7
         with:
           persist-credentials: false
       - name: "Get modern CMake and Ninja"
-        uses: "lukka/get-cmake@v4.2.3"
+        uses: "lukka/get-cmake@f176ccd3f28bda569c43aae4894f06b2435a3375" # lukka/get-cmake@v4.2.3
       - name: Prepare Vulkan SDK
-        uses: humbletim/setup-vulkan-sdk@v1.2.1
+        uses: "humbletim/setup-vulkan-sdk@c25f41106918cde0bf347e6f201277392b3a9e9d" # humbletim/setup-vulkan-sdk@v1.2.1
         with:
           vulkan-query-version: 1.3.290.0
           vulkan-components: Vulkan-Headers, Vulkan-Loader
diff --git a/.github/workflows/macos-build.yml b/.github/workflows/macos-build.yml
index 2e02bde65..6b0b76d8c 100644
--- a/.github/workflows/macos-build.yml
+++ b/.github/workflows/macos-build.yml
@@ -17,7 +17,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -55,7 +55,7 @@ jobs:
           tar -czvf openxr_loader_macos.tar.gz *
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v7
+        uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # actions/upload-artifact@v7
         with:
           name: openxr_loader_macos
           path: install/openxr_loader_macos.tar.gz
diff --git a/.github/workflows/msvc-build-preset.yml b/.github/workflows/msvc-build-preset.yml
index f68d4dd7d..afbdaa504 100644
--- a/.github/workflows/msvc-build-preset.yml
+++ b/.github/workflows/msvc-build-preset.yml
@@ -33,7 +33,7 @@ jobs:
       VULKAN_SDK_VERSION: "1.1.114.0"
       INSTALL_DIR: "${{ github.workspace }}/install"
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # actions/checkout@v7
         with:
           lfs: true
           fetch-tags: "${{ !github.event.release }}"
@@ -41,10 +41,10 @@ jobs:
           persist-credentials: false
 
       - name: Get modern CMake and Ninja
-        uses: lukka/get-cmake@v4.2.3
+        uses: "lukka/get-cmake@f176ccd3f28bda569c43aae4894f06b2435a3375" # lukka/get-cmake@v4.2.3
 
       - name: Add msbuild to PATH
-        uses: microsoft/setup-msbuild@v3
+        uses: "microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57" # microsoft/setup-msbuild@v3
 
       - name: Install Vulkan SDK
         run: ./.github/scripts/install_vulkan.ps1
@@ -70,7 +70,7 @@ jobs:
           INPUTS_BUILDTYPE: ${{ inputs.buildType }}
 
       - name: Upload Artifacts
-        uses: actions/upload-artifact@v7
+        uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # actions/upload-artifact@v7
         if: inputs.artifactName
         with:
           name: "${{ inputs.artifactName }}"
diff --git a/.github/workflows/windows-matrix.yml b/.github/workflows/windows-matrix.yml
index 3335f390c..4a9a37b57 100644
--- a/.github/workflows/windows-matrix.yml
+++ b/.github/workflows/windows-matrix.yml
@@ -19,7 +19,7 @@ jobs:
   #   outputs:
   #     matrix: "${{ steps.set-matrix.outputs.matrix }}"
   #   steps:
-  #     - uses: "actions/checkout@v7"
+  #     - uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # actions/checkout@v7
   #     - id: set-matrix
   #       run: "python3 .github/scripts/generate_windows_matrix_build.py matrix"
   msvc-build:
@@ -53,12 +53,12 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: "actions/checkout@v7"
+      - uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # actions/checkout@v7
         with:
           persist-credentials: false
 
       - name: Retrieve artifacts
-        uses: "actions/download-artifact@v8"
+        uses: "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c" # actions/download-artifact@v8
         with:
           path: artifacts
 
@@ -66,7 +66,7 @@ jobs:
         run: 'python .github/scripts/organize_windows_artifacts.py "${{ github.workspace }}" "${{ github.workspace }}/openxr_loader"'
 
       - name: Upload combined artifact
-        uses: "actions/upload-artifact@v7"
+        uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # actions/upload-artifact@v7
         with:
           name: openxr_loader_windows
           path: "${{ github.workspace }}/openxr_loader"
@@ -74,7 +74,7 @@ jobs:
       # NuGet stuff now
 
       - name: Setup NuGet
-        uses: "NuGet/setup-nuget@12c57947e9458a5b976961b08ea0706a17dd71ae"
+        uses: "NuGet/setup-nuget@12c57947e9458a5b976961b08ea0706a17dd71ae" # NuGet/setup-nuget@v3
         with:
           nuget-version: "5.x"
 
@@ -86,7 +86,7 @@ jobs:
         run: 'nuget pack "${{ github.workspace }}/openxr_loader_staging/OpenXR.Loader.nuspec" -OutputDirectory "${{ github.workspace }}/nuget"'
 
       - name: Upload NuGet artifact
-        uses: "actions/upload-artifact@v7"
+        uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # actions/upload-artifact@v7
         with:
           name: NuGet
           path: "${{ github.workspace }}/nuget"

From 63b1ae7b5314c7cec6985867f9ccf6c5aa4d10a4 Mon Sep 17 00:00:00 2001
From: Rylie Pavlik <rylie.pavlik@collabora.com>
Date: Mon, 6 Jul 2026 17:09:48 -0500
Subject: [PATCH 3/5] ci: Format workflows

---
 .github/workflows/macOS.yml             | 8 ++++----
 .github/workflows/msvc-build-preset.yml | 1 +
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/macOS.yml b/.github/workflows/macOS.yml
index 8d32a7bd9..b995d57da 100644
--- a/.github/workflows/macOS.yml
+++ b/.github/workflows/macOS.yml
@@ -5,10 +5,10 @@ name: macOS
 
 on:
   push:
-    branches: [ main ]
+    branches: [main]
 
   pull_request:
-    branches: [ main ]
+    branches: [main]
 
 permissions:
   contents: read
@@ -16,8 +16,8 @@ permissions:
 jobs:
   macOS-build:
     strategy:
-        matrix:
-          device: [
+      matrix:
+        device: [
             macos-15-intel, # Tests Mac x86_64
             macos-latest, # Tests Mac arm64
           ]
diff --git a/.github/workflows/msvc-build-preset.yml b/.github/workflows/msvc-build-preset.yml
index afbdaa504..2a3bb8b2e 100644
--- a/.github/workflows/msvc-build-preset.yml
+++ b/.github/workflows/msvc-build-preset.yml
@@ -59,6 +59,7 @@ jobs:
           cmake --fresh --preset $env:INPUTS_PRESET -S . -B $env:RUNNER_TEMP
         env:
           INPUTS_PRESET: ${{ inputs.preset }}
+
       - name: Build
         run: "cmake --build $env:RUNNER_TEMP --parallel --clean-first --config $env:INPUTS_BUILDTYPE"
         env:

From c9b864fc6b73f5d63b514c311c1abcbd434f7f8d Mon Sep 17 00:00:00 2001
From: Rylie Pavlik <rylie.pavlik@collabora.com>
Date: Mon, 6 Jul 2026 17:25:16 -0500
Subject: [PATCH 4/5] ci: Two missing names

---
 .github/workflows/msvc-build-preset.yml | 2 ++
 .github/workflows/windows-matrix.yml    | 1 +
 2 files changed, 3 insertions(+)

diff --git a/.github/workflows/msvc-build-preset.yml b/.github/workflows/msvc-build-preset.yml
index 2a3bb8b2e..0c24fe2a6 100644
--- a/.github/workflows/msvc-build-preset.yml
+++ b/.github/workflows/msvc-build-preset.yml
@@ -1,6 +1,8 @@
 # Copyright 2021-2026, Collabora, Ltd.
 # SPDX-License-Identifier: CC0-1.0
 
+name: "MSVC Build Preset"
+
 on:
   workflow_call:
     inputs:
diff --git a/.github/workflows/windows-matrix.yml b/.github/workflows/windows-matrix.yml
index 4a9a37b57..82fd04ee8 100644
--- a/.github/workflows/windows-matrix.yml
+++ b/.github/workflows/windows-matrix.yml
@@ -46,6 +46,7 @@ jobs:
       buildType: "RelWithDebInfo"
 
   organize-and-release-artifacts:
+    name: "Organize and combine Windows artifacts"
     if: inputs.organizeAndRelease
     needs:
       - msvc-build

From 7dbbab06314ef728a4515250b1d230091495ee5a Mon Sep 17 00:00:00 2001
From: Rylie Pavlik <rylie.pavlik@collabora.com>
Date: Mon, 6 Jul 2026 17:27:18 -0500
Subject: [PATCH 5/5] ci: Fix permissions

---
 .github/workflows/pr.yml       | 3 ++-
 .github/workflows/release.yml  | 3 ++-
 .github/workflows/snapshot.yml | 3 ++-
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 1556e817b..cc42618af 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -5,7 +5,8 @@ name: Pull request checks
 on:
   pull_request:
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   msvc-build:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 073497994..240f19ab7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,7 +7,8 @@ on:
     types: [published]
   workflow_dispatch:
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   # Currently Android artifacts are generated and signed internally before publication to GitHub.
diff --git a/.github/workflows/snapshot.yml b/.github/workflows/snapshot.yml
index 87fae9c3f..9d931f36f 100644
--- a/.github/workflows/snapshot.yml
+++ b/.github/workflows/snapshot.yml
@@ -5,7 +5,8 @@ name: Android Builds - Publish Snapshot
 on:
   workflow_dispatch:
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   android: