From 64c517c2dca6b9a6e22b0a2779eb5a77ad8b43c0 Mon Sep 17 00:00:00 2001
From: Sylwester Lachiewicz <slachiewicz@apache.org>
Date: Fri, 13 Nov 2026 20:32:49 +0000
Subject: [PATCH] Declare GITHUB_TOKEN permissions in workflows

---
 .github/workflows/maven.yml           | 3 +++
 .github/workflows/release-drafter.yml | 7 +++++++
 2 files changed, 10 insertions(+)

diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index 5465cbf0..7d0d63f6 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -19,6 +19,9 @@ name: GitHub CI
 
 on: [push, pull_request, workflow_dispatch]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build it
diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml
index adf40709..bc4653c3 100644
--- a/.github/workflows/release-drafter.yml
+++ b/.github/workflows/release-drafter.yml
@@ -4,6 +4,13 @@ on:
     branches:
       - master
   workflow_dispatch:
+
+permissions: {}
+
 jobs:
    update_release_draft:
+      # the called workflow drafts the release and reads merged pull requests
+      permissions:
+         contents: write
+         pull-requests: read
       uses: codehaus-plexus/.github/.github/workflows/release-drafter.yml@master