From 756effb4713f6ab9eb0b68e0423128a1579f6e36 Mon Sep 17 00:00:00 2001
From: Deluan <deluan@navidrome.org>
Date: Wed, 3 Dec 2025 17:43:07 -0500
Subject: [PATCH] fix(ci): add permissions for Docker manifest push jobs

---
 .github/workflows/pipeline.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/pipeline.yml b/.github/workflows/pipeline.yml
index 26544fe6e..aa42bf058 100644
--- a/.github/workflows/pipeline.yml
+++ b/.github/workflows/pipeline.yml
@@ -258,6 +258,8 @@ jobs:
 
   push-manifest-ghcr:
     name: Push to GHCR
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     needs: [build, check-push-enabled]
     if: needs.check-push-enabled.outputs.is_enabled == 'true'
@@ -292,6 +294,8 @@ jobs:
   push-manifest-dockerhub:
     name: Push to Docker Hub
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     needs: [build, check-push-enabled]
     if: needs.check-push-enabled.outputs.is_enabled == 'true' && vars.DOCKER_HUB_REPO != ''
     continue-on-error: true