From 1acc525fe0b667d575d55eab4b57afa771283c73 Mon Sep 17 00:00:00 2001
From: "hf-security-analysis[bot]"
 <265538906+hf-security-analysis[bot]@users.noreply.github.com>
Date: Wed, 23 Sep 2026 14:29:13 +0000
Subject: [PATCH] fix(ci): harden workflow files flagged on #776

---
 .github/workflows/rust.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/rust.yaml b/.github/workflows/rust.yaml
index e07e60cc..ae6c3188 100644
--- a/.github/workflows/rust.yaml
+++ b/.github/workflows/rust.yaml
@@ -11,8 +11,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   fmt:
+    permissions:
+      contents: read
     name: Rustfmt
     runs-on: ubuntu-latest
     steps:
@@ -33,6 +37,8 @@ jobs:
         run: ( cd kernel-port && cargo fmt --all -- --check )
 
   clippy:
+    permissions:
+      contents: read
     name: Clippy
     runs-on: ubuntu-latest
     steps:
@@ -62,6 +68,8 @@ jobs:
         run: ( cd kernel-port && cargo clippy -- -D warnings )
 
   test:
+    permissions:
+      contents: read
     name: Test
     runs-on: ubuntu-latest
     steps: