From 37a7c2c197ba8659e9b31ac86ac88d3d4a1a0198 Mon Sep 17 00:00:00 2001
From: Bartosz Taudul <wolf@nereid.pl>
Date: Sun, 9 Aug 2026 12:27:22 +0200
Subject: [PATCH] Add permissions and concurrency groups to all workflows

Set contents: read permissions on every workflow and add per-workflow
concurrency groups keyed on the git ref to deduplicate concurrent runs.
Release workflow keeps cancel-in-progress: false so a release build is
never canceled; job-level contents: write on attach-to-release is
preserved. Concurrency groups use hardcoded prefixes so reusable
workflows called from release.yml do not inherit the caller workflow
name and collide.
---
 .github/workflows/android.yml    | 7 +++++++
 .github/workflows/appimage.yml   | 7 +++++++
 .github/workflows/emscripten.yml | 7 +++++++
 .github/workflows/latex.yml      | 7 +++++++
 .github/workflows/linux-cli.yml  | 7 +++++++
 .github/workflows/linux.yml      | 7 +++++++
 .github/workflows/macos.yml      | 7 +++++++
 .github/workflows/mingw.yml      | 7 +++++++
 .github/workflows/release.yml    | 7 +++++++
 .github/workflows/windows.yml    | 7 +++++++
 10 files changed, 70 insertions(+)

diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index f1fd0cd5..f47d2755 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -7,6 +7,13 @@ on:
     branches: [ master ]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: android-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   CPM_SOURCE_CACHE: ${{ github.workspace }}/cpm-cache
 
diff --git a/.github/workflows/appimage.yml b/.github/workflows/appimage.yml
index 6e1288ad..dd32ccb4 100644
--- a/.github/workflows/appimage.yml
+++ b/.github/workflows/appimage.yml
@@ -8,6 +8,13 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: appimage-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   CPM_SOURCE_CACHE: ${{ github.workspace }}/cpm-cache
 
diff --git a/.github/workflows/emscripten.yml b/.github/workflows/emscripten.yml
index 7e639df7..13be2753 100644
--- a/.github/workflows/emscripten.yml
+++ b/.github/workflows/emscripten.yml
@@ -7,6 +7,13 @@ on:
     branches: [ master ]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: emscripten-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   CPM_SOURCE_CACHE: ${{ github.workspace }}/cpm-cache
 
diff --git a/.github/workflows/latex.yml b/.github/workflows/latex.yml
index 7a0f9474..731d2b44 100644
--- a/.github/workflows/latex.yml
+++ b/.github/workflows/latex.yml
@@ -8,6 +8,13 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: latex-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build-manual:
 
diff --git a/.github/workflows/linux-cli.yml b/.github/workflows/linux-cli.yml
index 9479a5df..0d13781e 100644
--- a/.github/workflows/linux-cli.yml
+++ b/.github/workflows/linux-cli.yml
@@ -8,6 +8,13 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: linux-cli-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   CPM_SOURCE_CACHE: ${{ github.workspace }}/cpm-cache
 
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 96af2619..5e61f141 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -7,6 +7,13 @@ on:
     branches: [ master ]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: linux-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   CPM_SOURCE_CACHE: ${{ github.workspace }}/cpm-cache
 
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index 9cb0e040..900ec107 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -8,6 +8,13 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: macos-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   CPM_SOURCE_CACHE: ${{ github.workspace }}/cpm-cache
 
diff --git a/.github/workflows/mingw.yml b/.github/workflows/mingw.yml
index c4398a22..b2bcd46b 100644
--- a/.github/workflows/mingw.yml
+++ b/.github/workflows/mingw.yml
@@ -7,6 +7,13 @@ on:
     branches: [ master ]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: mingw-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   CPM_SOURCE_CACHE: ${{ github.workspace }}/cpm-cache
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7ac98e6f..5a6b1395 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,6 +4,13 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.event.release.tag_name }}
+  cancel-in-progress: false
+
 jobs:
   release-build-windows:
     uses: ./.github/workflows/windows.yml
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 557dc180..2a97a8b7 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -8,6 +8,13 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: windows-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   CPM_SOURCE_CACHE: ${{ github.workspace }}/cpm-cache