set read as workflow default

kevinjqliu · kevinjqliu · commit b5b9ef385572 · 2026-02-22T17:17:30.000-08:00
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -27,12 +27,14 @@ on:
   schedule:
     - cron: '16 4 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Analyze Actions
     runs-on: ubuntu-latest
     permissions:
-      contents: read
       security-events: write
       packages: read
 
diff --git a/.github/workflows/nightly-pypi-build.yml b/.github/workflows/nightly-pypi-build.yml
@@ -70,7 +70,6 @@ jobs:
       url: https://test.pypi.org/p/pyiceberg
 
     permissions:
-      contents: read
       id-token: write  # IMPORTANT: mandatory for trusted publishing
 
     steps:
