From 3c3a25a3199d3195b7e650a5eb8d97156605b217 Mon Sep 17 00:00:00 2001
From: Aly <16789036+aly-obol@users.noreply.github.com>
Date: Thu, 22 Oct 2026 16:46:39 -0400
Subject: [PATCH] ci: declare token permissions for jobs that write

These jobs rely on the org default GITHUB_TOKEN (read+write). Declaring what they need lets the org default become read-only.

Refs ObolNetwork/obol-infrastructure#3294
---
 .github/workflows/build-push-deploy-promrated.yml | 3 +++
 .github/workflows/build-push-deploy.yml           | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/.github/workflows/build-push-deploy-promrated.yml b/.github/workflows/build-push-deploy-promrated.yml
index dacbedc69..211ed7766 100644
--- a/.github/workflows/build-push-deploy-promrated.yml
+++ b/.github/workflows/build-push-deploy-promrated.yml
@@ -9,6 +9,9 @@ on:
 
 jobs:
   build-docker:
+    permissions:
+      contents: read
+      packages: write
     runs-on: ubuntu-latest
     name: Build Docker Image
     steps:
diff --git a/.github/workflows/build-push-deploy.yml b/.github/workflows/build-push-deploy.yml
index 5887269a1..5a086a4d9 100644
--- a/.github/workflows/build-push-deploy.yml
+++ b/.github/workflows/build-push-deploy.yml
@@ -9,6 +9,9 @@ on:
 name: Build and Publish Docker Image
 jobs:
   build-docker:
+    permissions:
+      contents: read
+      packages: write
     runs-on: charon-ci
     name: Build Docker Image
     steps: