From 2abbb067c7c6ec60470768b87d0f95792a4093b2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Rombauts?= <sebastien.rombauts@gmail.com>
Date: Thu, 24 Sep 2026 11:58:52 +0200
Subject: [PATCH 1/2] Simplify submodule checkout

Let actions/checkout fetch googletest only in jobs that build the
tests, and avoid unnecessary submodule initialization elsewhere.
---
 .github/workflows/cmake.yml             | 3 ++-
 .github/workflows/cmake_builtin_lib.yml | 3 ++-
 .github/workflows/codeql.yml            | 1 -
 .github/workflows/coverage.yml          | 3 ++-
 .github/workflows/coverity.yml          | 1 -
 .github/workflows/quality.yml           | 4 ++--
 6 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/cmake.yml b/.github/workflows/cmake.yml
index 8a9c9a12..e4d1e23c 100644
--- a/.github/workflows/cmake.yml
+++ b/.github/workflows/cmake.yml
@@ -118,7 +118,8 @@ jobs:
     steps:
     - name: Checkout ${{ github.ref_name }}
       uses: actions/checkout@v7
-    - run: git submodule update --init --recursive
+      with:
+        submodules: recursive
     - name: set extra GITHUB_PATH ${{ matrix.config.extra_path }} (for MinGW)
       shell: bash
       run: echo "${{ matrix.config.extra_path }}" >> $GITHUB_PATH
diff --git a/.github/workflows/cmake_builtin_lib.yml b/.github/workflows/cmake_builtin_lib.yml
index 63b77aa9..b16cc33c 100644
--- a/.github/workflows/cmake_builtin_lib.yml
+++ b/.github/workflows/cmake_builtin_lib.yml
@@ -24,7 +24,8 @@ jobs:
     steps:
     - name: Checkout ${{ github.ref_name }}
       uses: actions/checkout@v7
-    - run: git submodule update --init --recursive
+      with:
+        submodules: recursive
     - run: mkdir build
     - run: cmake -G "Unix Makefiles" -DCMAKE_VERBOSE_MAKEFILE=ON -DCMAKE_BUILD_TYPE=Debug -DSQLITECPP_INTERNAL_SQLITE=OFF -DSQLITE_OMIT_LOAD_EXTENSION=ON -DSQLITECPP_BUILD_TESTS=ON -DSQLITECPP_BUILD_EXAMPLES=ON -DSQLITECPP_RUN_CPPCHECK=OFF -DSQLITECPP_RUN_CPPLINT=OFF .. 
       working-directory: build
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index cc2c56a7..4d296b83 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -23,7 +23,6 @@ jobs:
     steps:
     - name: Checkout ${{ github.ref_name }}
       uses: actions/checkout@v7
-    - run: git submodule update --init --recursive
 
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v4
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index fb71cd9b..ee2b0a02 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -10,7 +10,8 @@ jobs:
     steps:
     - name: Checkout ${{ github.ref_name }}
       uses: actions/checkout@v7
-    - run: git submodule update --init --recursive
+      with:
+        submodules: recursive
 
     - name: Install lcov
       run: sudo apt-get update && sudo apt-get install -y lcov
diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
index 62149f3c..902f07d2 100644
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@@ -17,7 +17,6 @@ jobs:
     steps:
     - name: Checkout ${{ github.ref_name }}
       uses: actions/checkout@v7
-    - run: git submodule update --init --recursive
 
     - run: mkdir build
 
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index 94c8f2cc..3c12cd98 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -23,7 +23,8 @@ jobs:
     steps:
     - name: Checkout ${{ github.ref_name }}
       uses: actions/checkout@v7
-    - run: git submodule update --init --recursive
+      with:
+        submodules: recursive
 
     - name: Configure
       env:
@@ -55,7 +56,6 @@ jobs:
     steps:
     - name: Checkout ${{ github.ref_name }}
       uses: actions/checkout@v7
-    - run: git submodule update --init --recursive
 
     - name: Install cppcheck
       run: sudo apt-get update && sudo apt-get install -y cppcheck

From 29305616019229630c7fe178ec78b95c2f831ad2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Rombauts?= <sebastien.rombauts@gmail.com>
Date: Thu, 24 Sep 2026 11:59:15 +0200
Subject: [PATCH 2/2] Restrict workflow token permissions

Give ordinary CI workflows read-only repository access by default.
CodeQL keeps its explicit security-events write permission.
---
 .github/workflows/cmake.yml                | 3 +++
 .github/workflows/cmake_builtin_lib.yml    | 3 +++
 .github/workflows/cmake_policy_4_4.yml     | 3 +++
 .github/workflows/cmake_standards.yml      | 3 +++
 .github/workflows/cmake_subdir_example.yml | 3 +++
 .github/workflows/coverage.yml             | 3 +++
 .github/workflows/coverity.yml             | 3 +++
 .github/workflows/meson.yml                | 3 +++
 8 files changed, 24 insertions(+)

diff --git a/.github/workflows/cmake.yml b/.github/workflows/cmake.yml
index e4d1e23c..cd029e40 100644
--- a/.github/workflows/cmake.yml
+++ b/.github/workflows/cmake.yml
@@ -2,6 +2,9 @@ name: CMake build
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   assertion-handler:
     name: Custom assertion handler (${{ matrix.build_type }})
diff --git a/.github/workflows/cmake_builtin_lib.yml b/.github/workflows/cmake_builtin_lib.yml
index b16cc33c..c17de021 100644
--- a/.github/workflows/cmake_builtin_lib.yml
+++ b/.github/workflows/cmake_builtin_lib.yml
@@ -2,6 +2,9 @@ name: CMake SQLite3 builtin library
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: ${{ matrix.config.name }}
diff --git a/.github/workflows/cmake_policy_4_4.yml b/.github/workflows/cmake_policy_4_4.yml
index 50fb2ba1..c218cf79 100644
--- a/.github/workflows/cmake_policy_4_4.yml
+++ b/.github/workflows/cmake_policy_4_4.yml
@@ -2,6 +2,9 @@ name: Latest CMake / 4.4 policies
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: ${{ matrix.os }}
diff --git a/.github/workflows/cmake_standards.yml b/.github/workflows/cmake_standards.yml
index 4d31b67d..d9518880 100644
--- a/.github/workflows/cmake_standards.yml
+++ b/.github/workflows/cmake_standards.yml
@@ -2,6 +2,9 @@ name: CMake C++17/C++20 standards
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: C++${{ matrix.library_standard }} library / C++${{ matrix.consumer_standard }} consumer
diff --git a/.github/workflows/cmake_subdir_example.yml b/.github/workflows/cmake_subdir_example.yml
index e6dfe009..628dfd13 100644
--- a/.github/workflows/cmake_subdir_example.yml
+++ b/.github/workflows/cmake_subdir_example.yml
@@ -2,6 +2,9 @@ name: CMake build of example in subdirectory
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: ${{ matrix.config.name }}
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index ee2b0a02..a63d9c3b 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -2,6 +2,9 @@ name: Coverage
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   coverage:
     name: Ubuntu GCC GCov Coverage
diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
index 902f07d2..dbcb3a4e 100644
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@@ -8,6 +8,9 @@ on:
     branches: [master]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   coverity:
     name: Ubuntu GCC Coverity Scan
diff --git a/.github/workflows/meson.yml b/.github/workflows/meson.yml
index 423e5f54..028c6a37 100644
--- a/.github/workflows/meson.yml
+++ b/.github/workflows/meson.yml
@@ -2,6 +2,9 @@ name: Meson build
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: (Meson) ${{ matrix.config.name }}