10 files changed, 34 insertions, 5 deletions
diff --git a/.github/workflows/binaries_dev.yml b/.github/workflows/binaries_dev.yml
index 69602bfb7..29b1cf6ab 100644
--- a/.github/workflows/binaries_dev.yml
+++ b/.github/workflows/binaries_dev.yml
@@ -4,9 +4,14 @@ on:
   push:
     branches: [ master ]
 
+permissions:
+  contents: read
+
 jobs:
 
   cleanup:
+    permissions:
+      contents: write  # for mknejp/delete-release-assets to delete release assets
     runs-on: ubuntu-latest
 
     steps:
@@ -21,6 +26,8 @@ jobs:
             weed-*
 
   build_dev_linux_windows:
+    permissions:
+      contents: write  # for wangyoucao577/go-release-action to upload release assets
     needs: cleanup
     runs-on: ubuntu-latest
     strategy:
@@ -68,6 +75,8 @@ jobs:
           asset_name: "weed-${{ env.BUILD_TIME }}-${{ matrix.goos }}-${{ matrix.goarch }}"
 
   build_dev_darwin:
+    permissions:
+      contents: write  # for wangyoucao577/go-release-action to upload release assets
     needs: build_dev_linux_windows
     runs-on: ubuntu-latest
     strategy:
diff --git a/.github/workflows/binaries_release0.yml b/.github/workflows/binaries_release0.yml
index 300757a70..3a6cb734d 100644
--- a/.github/workflows/binaries_release0.yml
+++ b/.github/workflows/binaries_release0.yml
@@ -11,9 +11,14 @@ on:
   workflow_dispatch:
 
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
+permissions:
+  contents: read
+
 jobs:
 
   build-release-binaries_windows:
+    permissions:
+      contents: write  # for wangyoucao577/go-release-action to upload release assets
     runs-on: ubuntu-latest
     strategy:
       matrix:
diff --git a/.github/workflows/binaries_release1.yml b/.github/workflows/binaries_release1.yml
index d7594ec19..d0a51ce8f 100644
--- a/.github/workflows/binaries_release1.yml
+++ b/.github/workflows/binaries_release1.yml
@@ -11,9 +11,14 @@ on:
   workflow_dispatch:
 
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
+permissions:
+  contents: read
+
 jobs:
 
   build-release-binaries_linux:
+    permissions:
+      contents: write  # for wangyoucao577/go-release-action to upload release assets
     runs-on: ubuntu-latest
     strategy:
       matrix:
diff --git a/.github/workflows/binaries_release2.yml b/.github/workflows/binaries_release2.yml
index c605004eb..09e8fc7ae 100644
--- a/.github/workflows/binaries_release2.yml
+++ b/.github/workflows/binaries_release2.yml
@@ -11,9 +11,14 @@ on:
   workflow_dispatch:
 
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
+permissions:
+  contents: read
+
 jobs:
 
   build-release-binaries_darwin:
+    permissions:
+      contents: write  # for wangyoucao577/go-release-action to upload release assets
     runs-on: ubuntu-latest
     strategy:
       matrix:
diff --git a/.github/workflows/binaries_release3.yml b/.github/workflows/binaries_release3.yml
index f87f289d1..c96a91cee 100644
--- a/.github/workflows/binaries_release3.yml
+++ b/.github/workflows/binaries_release3.yml
@@ -11,9 +11,14 @@ on:
   workflow_dispatch:
 
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
+permissions:
+  contents: read
+
 jobs:
 
   build-release-binaries_freebsd:
+    permissions:
+      contents: write  # for wangyoucao577/go-release-action to upload release assets
     runs-on: ubuntu-latest
     strategy:
       matrix:
diff --git a/.github/workflows/container_dev.yml b/.github/workflows/container_dev.yml
index a8c94f6a4..125d5a5a0 100644
--- a/.github/workflows/container_dev.yml
+++ b/.github/workflows/container_dev.yml
@@ -20,7 +20,7 @@ jobs:
       -
         name: Docker meta
         id: docker_meta
-        uses: docker/metadata-action@e5622373a38e60fb6d795a4421e56882f2d7a681 # v3
+        uses: docker/metadata-action@f2a13332ac1ce8c0a71aeac48a150dbb1838ab67 # v3
         with:
           images: |
             chrislusf/seaweedfs
diff --git a/.github/workflows/container_latest.yml b/.github/workflows/container_latest.yml
index b8d0b063a..c3a789b7f 100644
--- a/.github/workflows/container_latest.yml
+++ b/.github/workflows/container_latest.yml
@@ -21,7 +21,7 @@ jobs:
       -
         name: Docker meta
         id: docker_meta
-        uses: docker/metadata-action@e5622373a38e60fb6d795a4421e56882f2d7a681 # v3
+        uses: docker/metadata-action@f2a13332ac1ce8c0a71aeac48a150dbb1838ab67 # v3
         with:
           images: |
             chrislusf/seaweedfs
diff --git a/.github/workflows/container_release1.yml b/.github/workflows/container_release1.yml
index 7e9ce85e5..99ba05e10 100644
--- a/.github/workflows/container_release1.yml
+++ b/.github/workflows/container_release1.yml
@@ -20,7 +20,7 @@ jobs:
       -
         name: Docker meta
         id: docker_meta
-        uses: docker/metadata-action@e5622373a38e60fb6d795a4421e56882f2d7a681 # v3
+        uses: docker/metadata-action@f2a13332ac1ce8c0a71aeac48a150dbb1838ab67 # v3
         with:
           images: |
             chrislusf/seaweedfs
diff --git a/.github/workflows/container_release2.yml b/.github/workflows/container_release2.yml
index 5a20fbd51..f9ff07d39 100644
--- a/.github/workflows/container_release2.yml
+++ b/.github/workflows/container_release2.yml
@@ -21,7 +21,7 @@ jobs:
       -
         name: Docker meta
         id: docker_meta
-        uses: docker/metadata-action@e5622373a38e60fb6d795a4421e56882f2d7a681 # v3
+        uses: docker/metadata-action@f2a13332ac1ce8c0a71aeac48a150dbb1838ab67 # v3
         with:
           images: |
             chrislusf/seaweedfs
diff --git a/.github/workflows/container_release3.yml b/.github/workflows/container_release3.yml
index 92c36a311..4f489ea35 100644
--- a/.github/workflows/container_release3.yml
+++ b/.github/workflows/container_release3.yml
@@ -21,7 +21,7 @@ jobs:
       -
         name: Docker meta
         id: docker_meta
-        uses: docker/metadata-action@e5622373a38e60fb6d795a4421e56882f2d7a681 # v3
+        uses: docker/metadata-action@f2a13332ac1ce8c0a71aeac48a150dbb1838ab67 # v3
         with:
           images: |
             chrislusf/seaweedfs