From b7ad9219f2fd08f94df903358676de7eea735a49 Mon Sep 17 00:00:00 2001 From: Adnan Khan Date: Tue, 21 Oct 2025 17:22:00 -0400 Subject: [PATCH 1/5] ci: scope down permissions for pull.yml --- .github/workflows/pull.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/pull.yml b/.github/workflows/pull.yml index 146aae1b..3f7e1836 100644 --- a/.github/workflows/pull.yml +++ b/.github/workflows/pull.yml @@ -3,6 +3,9 @@ name: Pull Request Checks on: pull_request: +permissions: + contents: read + jobs: call-integration-tests: name: Run Integration Tests From 9814e953c491c864161e49b29cbf706e5bba856d Mon Sep 17 00:00:00 2001 From: Adnan Khan Date: Tue, 21 Oct 2025 17:22:02 -0400 Subject: [PATCH 2/5] ci: scope down permissions for repo-sync.yml --- .github/workflows/repo-sync.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/repo-sync.yml b/.github/workflows/repo-sync.yml index e3776d39..cf250b94 100644 --- a/.github/workflows/repo-sync.yml +++ b/.github/workflows/repo-sync.yml @@ -3,6 +3,10 @@ name: Repo Sync on: workflow_dispatch: # allows triggering this manually through the Actions UI +permissions: + contents: write + pull-requests: write + jobs: repo-sync: name: Repo Sync From 0cfb34b4f441d976e4a0c74d972aa2a936b13df8 Mon Sep 17 00:00:00 2001 From: Adnan Khan Date: Tue, 21 Oct 2025 17:22:04 -0400 Subject: [PATCH 3/5] ci: scope down permissions for push.yml --- .github/workflows/push.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 5f48c1e8..8910a868 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -4,6 +4,9 @@ on: push: branches: master +permissions: + contents: read + jobs: call-integration-tests: name: Run Integration Tests From 69a283a16ef3e2ca82a0e50a47f4d2915c1f98c1 Mon Sep 17 00:00:00 2001 From: Adnan Khan Date: Tue, 21 Oct 2025 17:22:05 -0400 Subject: [PATCH 4/5] ci: scope down permissions for ci_tests.yaml --- .github/workflows/ci_tests.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/ci_tests.yaml b/.github/workflows/ci_tests.yaml index fa058fcb..0a780a6b 100644 --- a/.github/workflows/ci_tests.yaml +++ b/.github/workflows/ci_tests.yaml @@ -7,6 +7,9 @@ on: schedule: - cron: '0 0 * * *' +permissions: + contents: read + jobs: tests: runs-on: ${{ matrix.platform.os }} From 1aa781a2cbd4e8538889b8ad65c8ca9f722d9a4e Mon Sep 17 00:00:00 2001 From: Adnan Khan Date: Tue, 21 Oct 2025 17:22:07 -0400 Subject: [PATCH 5/5] ci: scope down permissions for ci_static-analysis.yaml --- .github/workflows/ci_static-analysis.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/ci_static-analysis.yaml b/.github/workflows/ci_static-analysis.yaml index f1ef1ddc..1dd67a65 100644 --- a/.github/workflows/ci_static-analysis.yaml +++ b/.github/workflows/ci_static-analysis.yaml @@ -7,6 +7,9 @@ on: schedule: - cron: '0 0 * * *' +permissions: + contents: read + jobs: analysis: runs-on: ubuntu-latest