asyncapi · hriszc · Mar 10, 2026
@@ -9,6 +9,9 @@ on:
     types:
       - created
 
+permissions:
+  issues: write
+
 jobs:
   add-labels:
     if: ${{(!github.event.issue.pull_request && github.event.issue.state != 'closed' && github.actor != 'asyncapi-bot') && (contains(github.event.comment.body, '/good-first-issue') || contains(github.event.comment.body, '/gfi' ))}}

@@ -14,6 +14,9 @@ on:
     types:
       - created
 
+permissions:
+  issues: write
+
 env:
   BOUNTY_PROGRAM_LABELS_JSON: |
     [

@@ -8,6 +8,10 @@ on:
         types: 
             - created
 
+permissions:
+  issues: write
+  pull-requests: write
+
 jobs:
   create_help_comment_pr:
     if: ${{ github.event.issue.pull_request && startsWith(github.event.comment.body, '/help') && github.actor != 'asyncapi-bot' }}
@@ -64,4 +68,4 @@ jobs:
               - \`/good-first-issue {js | ts | java | go | docs | design | ci-cd}\` or \`/gfi {js | ts | java | go | docs | design | ci-cd}\` - label an issue as a \`good first issue\`.
               example: \`/gfi js\` or \`/good-first-issue ci-cd\`
               - \`/transfer-issue {repo-name}\` or \`/ti {repo-name}\` - transfer issue from the source repository to the other repository passed by the user. example: \`/ti cli\` or \`/transfer-issue cli\`.`
-            })
+            })
@@ -14,6 +14,9 @@ on:
   discussion:
     types: [created]
 
+permissions:
+  contents: read
+
 jobs:
   issue:
     if: github.event_name == 'issues' && github.actor != 'asyncapi-bot' && github.actor != 'dependabot[bot]' && github.actor != 'dependabot-preview[bot]'

@@ -7,6 +7,9 @@ on:
   pull_request_target:
     types: [opened, reopened, synchronize, edited, ready_for_review]
 
+permissions:
+  pull-requests: write
+
 jobs:
   lint-pr-title:
     name: Lint PR title

@@ -25,6 +25,9 @@ on:
     types:
       - created
 
+permissions:
+  contents: read
+
 jobs:
   issue:
     if: github.event_name == 'issues' && contains(github.event.issue.body, '@asyncapi/tsc_members')

@@ -7,6 +7,9 @@ on:
     paths:
       - '.github/workflows/**'
 
+permissions:
+  contents: read
+
 jobs:
   yaml-lint:
     runs-on: ubuntu-latest
@@ -69,4 +72,19 @@ jobs:
                 }
               }
             }
-            validateWorkflows();
+            validateWorkflows();
+
+  workflow-security:
+    name: Workflow security checks
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Run actionlint
+        uses: rhysd/actionlint@v1
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@v0.1.2
+        with:
+          persona: pedantic
@@ -11,6 +11,10 @@ on:
     types:
       - opened
 
+permissions:
+  issues: write
+  pull-requests: write
+
 jobs:
   welcome:
     name: Post welcome message
-Original file line number
+Diff line change
@@ Expand Up / @@ -14,6 +14,9 @@ on: @@
         types:
           - created
+    permissions:
+      issues: write
     env:
       BOUNTY_PROGRAM_LABELS_JSON: |
         [
@@ Expand Down @@