From e730ad49d719473467c624b3407dd4c090b707ec Mon Sep 17 00:00:00 2001 From: Adnan Khan Date: Tue, 21 Oct 2025 13:49:36 -0400 Subject: [PATCH 1/2] ci: scope down permissions for repo-sync.yml --- .github/workflows/repo-sync.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/repo-sync.yml b/.github/workflows/repo-sync.yml index b7605354..a55d58b8 100644 --- a/.github/workflows/repo-sync.yml +++ b/.github/workflows/repo-sync.yml @@ -3,6 +3,10 @@ name: Repo Sync on: workflow_dispatch: # allows triggering this manually through the Actions UI +permissions: + contents: write + pull-requests: write + jobs: repo-sync: name: Repo Sync From 9db0c38666bbe0015e5d1baf52b0408369c59156 Mon Sep 17 00:00:00 2001 From: Adnan Khan Date: Tue, 21 Oct 2025 13:49:38 -0400 Subject: [PATCH 2/2] ci: scope down permissions for ci_static-analysis.yaml --- .github/workflows/ci_static-analysis.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/ci_static-analysis.yaml b/.github/workflows/ci_static-analysis.yaml index 3e15bfbb..9e28f477 100644 --- a/.github/workflows/ci_static-analysis.yaml +++ b/.github/workflows/ci_static-analysis.yaml @@ -3,6 +3,9 @@ name: static analysis on: ["pull_request", "push"] +permissions: + contents: read + jobs: not-grep: runs-on: ubuntu-latest