From cd0ef12787f29b254288de2781685647e015d6a7 Mon Sep 17 00:00:00 2001
From: James Blair <mail@jamesblair.net>
Date: Sun, 11 Aug 2024 21:49:51 +1200
Subject: [PATCH] Backport setting default read-only permissions.

Backports commit: #5a02298ad5a947214ba02655b0a93ac01d4c178a

Signed-off-by: James Blair <mail@jamesblair.net>
---
 .github/workflows/gh-workflow-approve.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/gh-workflow-approve.yaml b/.github/workflows/gh-workflow-approve.yaml
index c87942e9a1a..c85d859e6b8 100644
--- a/.github/workflows/gh-workflow-approve.yaml
+++ b/.github/workflows/gh-workflow-approve.yaml
@@ -1,5 +1,6 @@
 ---
 name: Approve GitHub Workflows
+permissions: read-all
 
 on:
   pull_request_target: