diff --git a/.github/workflows/ci_static-analysis.yaml b/.github/workflows/ci_static-analysis.yaml
index f5458d4..83269e3 100644
--- a/.github/workflows/ci_static-analysis.yaml
+++ b/.github/workflows/ci_static-analysis.yaml
@@ -3,6 +3,10 @@ name: static analysis
 
 on: ["pull_request", "push"]
 
+
+permissions:
+  contents: read
+
 jobs:
   not-grep:
     runs-on: ubuntu-latest