From 01f154f7ede764be48dc3971b9cdb8ec37b50663 Mon Sep 17 00:00:00 2001 From: Adnan Khan Date: Thu, 11 Dec 2025 18:22:54 -0500 Subject: [PATCH 1/4] ci: scope down permissions for auto_assign.yml --- .github/workflows/auto_assign.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/auto_assign.yml b/.github/workflows/auto_assign.yml index 093e194..9167b24 100644 --- a/.github/workflows/auto_assign.yml +++ b/.github/workflows/auto_assign.yml @@ -3,6 +3,9 @@ on: pull_request: types: [opened, ready_for_review] +permissions: + pull-requests: write + jobs: add-reviews: runs-on: ubuntu-latest From f04ef52374edcf86e208389294ee9802c6c3ce57 Mon Sep 17 00:00:00 2001 From: Adnan Khan Date: Thu, 11 Dec 2025 18:22:56 -0500 Subject: [PATCH 2/4] ci: scope down permissions for label_pr_on_title.yml --- .github/workflows/label_pr_on_title.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/label_pr_on_title.yml b/.github/workflows/label_pr_on_title.yml index e6ce47d..671795b 100644 --- a/.github/workflows/label_pr_on_title.yml +++ b/.github/workflows/label_pr_on_title.yml @@ -6,6 +6,9 @@ on: types: - completed +permissions: + pull-requests: write + jobs: get_pr_details: # Guardrails to only ever run if PR recording workflow was indeed From 0dfba68f471e6810da6fc8fbe40b1168fe50f8af Mon Sep 17 00:00:00 2001 From: Adnan Khan Date: Thu, 11 Dec 2025 18:22:58 -0500 Subject: [PATCH 3/4] ci: scope down permissions for on_merged_pr.yml --- .github/workflows/on_merged_pr.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/on_merged_pr.yml b/.github/workflows/on_merged_pr.yml index 2bce046..6da5d04 100644 --- a/.github/workflows/on_merged_pr.yml +++ b/.github/workflows/on_merged_pr.yml @@ -6,6 +6,9 @@ on: types: - completed +permissions: + issues: write + jobs: get_pr_details: if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success' From 2d33b7ca8296711cf8371f942a68844ea65166ec Mon Sep 17 00:00:00 2001 From: Adnan Khan Date: Thu, 11 Dec 2025 18:23:00 -0500 Subject: [PATCH 4/4] ci: scope down permissions for on_opened_pr.yml --- .github/workflows/on_opened_pr.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/on_opened_pr.yml b/.github/workflows/on_opened_pr.yml index 9712a3f..0bb285c 100644 --- a/.github/workflows/on_opened_pr.yml +++ b/.github/workflows/on_opened_pr.yml @@ -6,6 +6,9 @@ on: types: - completed +permissions: + pull-requests: write + jobs: get_pr_details: if: ${{ github.event.workflow_run.conclusion == 'success' }}