From 0e7a78e2732b2b616ffa2c533d39f6d9f1f81f1a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tim=20Pr=C3=BCssing?= <github@timbrust.de>
Date: Sat, 19 Sep 2026 15:05:59 +0200
Subject: [PATCH] build(ci): rename branch and add workflow permissions

---
 .github/workflows/buildx.yml      | 13 ++++++++-----
 .github/workflows/dockerimage.yml |  5 ++++-
 .github/workflows/hadolint.yml    |  5 ++++-
 3 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/buildx.yml b/.github/workflows/buildx.yml
index bb00cbb..6ec05b8 100644
--- a/.github/workflows/buildx.yml
+++ b/.github/workflows/buildx.yml
@@ -5,9 +5,12 @@ on:
     - cron: "37 05 * * *"
   push:
     branches:
-      - master
+      - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   buildx:
     runs-on: ubuntu-latest
@@ -104,7 +107,7 @@ jobs:
 
       - name: Docker Buildx (build)
         uses: docker/build-push-action@v7.4.0
-        if: success() && !contains(github.ref, 'master')
+        if: success() && github.ref_name != 'main'
         with:
           push: false
           context: ${{ steps.buildpath.outputs.path }}
@@ -114,7 +117,7 @@ jobs:
           tags: ${{ steps.prepare.outputs.tags }}
 
       - name: Docker Login
-        if: success() && github.event_name != 'pull_request' && contains(github.ref, 'master')
+        if: success() && github.event_name != 'pull_request' && github.ref_name == 'main'
         uses: docker/login-action@v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
@@ -122,7 +125,7 @@ jobs:
 
       - name: Docker Buildx (push)
         uses: docker/build-push-action@v7.4.0
-        if: success() && github.event_name != 'pull_request' && contains(github.ref, 'master')
+        if: success() && github.event_name != 'pull_request' && github.ref_name == 'main'
         with:
           push: true
           context: ${{ steps.buildpath.outputs.path }}
@@ -132,7 +135,7 @@ jobs:
           tags: ${{ steps.prepare.outputs.tags }}
 
       - name: Inspect Image
-        if: always() && github.event_name != 'pull_request' && contains(github.ref, 'master')
+        if: always() && github.event_name != 'pull_request' && github.ref_name == 'main'
         run: |
           docker buildx imagetools inspect $(echo "${{ steps.prepare.outputs.tags }}" | cut -d',' -f1)
 
diff --git a/.github/workflows/dockerimage.yml b/.github/workflows/dockerimage.yml
index b0d3ec1..8bdfa9e 100644
--- a/.github/workflows/dockerimage.yml
+++ b/.github/workflows/dockerimage.yml
@@ -3,10 +3,13 @@ name: Test Docker image
 on:
   push:
     branches:
-      - master
+      - main
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/hadolint.yml b/.github/workflows/hadolint.yml
index 0156d84..f86c480 100644
--- a/.github/workflows/hadolint.yml
+++ b/.github/workflows/hadolint.yml
@@ -3,9 +3,12 @@ name: Lint Dockerfiles
 on:
   push:
     branches:
-      - master
+      - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: macos-latest