From 51e08fb8f11f1786a87f78eec6bd1beefdc80bdc Mon Sep 17 00:00:00 2001 From: Adnan Khan Date: Tue, 21 Oct 2025 14:09:04 -0400 Subject: [PATCH 1/4] ci: scope down permissions for benchmark.yml --- .github/workflows/benchmark.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml index 1a90fdb..46ee1d4 100644 --- a/.github/workflows/benchmark.yml +++ b/.github/workflows/benchmark.yml @@ -5,6 +5,10 @@ on: branches: [ main ] pull_request: +permissions: + contents: write + pull-requests: write + jobs: benchmark: runs-on: ubuntu-latest From d5275ea76325c410a82e6849a81b94db364f1990 Mon Sep 17 00:00:00 2001 From: Adnan Khan Date: Tue, 21 Oct 2025 14:09:06 -0400 Subject: [PATCH 2/4] ci: scope down permissions for check-format.yml --- .github/workflows/check-format.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/check-format.yml b/.github/workflows/check-format.yml index 8465071..ed8072f 100644 --- a/.github/workflows/check-format.yml +++ b/.github/workflows/check-format.yml @@ -9,6 +9,9 @@ on: - main - feature/** +permissions: + contents: read + jobs: check-code-format: runs-on: ubuntu-latest From 66b819fc0b50be002dc82c997723cf33a32cc9b2 Mon Sep 17 00:00:00 2001 From: Adnan Khan Date: Tue, 21 Oct 2025 14:09:08 -0400 Subject: [PATCH 3/4] ci: scope down permissions for stale_issue.yml --- .github/workflows/stale_issue.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/stale_issue.yml b/.github/workflows/stale_issue.yml index 482c708..1d08d8f 100644 --- a/.github/workflows/stale_issue.yml +++ b/.github/workflows/stale_issue.yml @@ -6,6 +6,10 @@ on: schedule: - cron: "0 10 * * *" +permissions: + issues: write + pull-requests: write + jobs: cleanup: runs-on: ubuntu-latest From 7ccb413b2595de1c7ee262a152a2f0a21eb256f2 Mon Sep 17 00:00:00 2001 From: Adnan Khan Date: Tue, 21 Oct 2025 14:09:09 -0400 Subject: [PATCH 4/4] ci: scope down permissions for python-package.yml --- .github/workflows/python-package.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/python-package.yml b/.github/workflows/python-package.yml index 382b8cb..e1e2cab 100644 --- a/.github/workflows/python-package.yml +++ b/.github/workflows/python-package.yml @@ -8,6 +8,9 @@ on: branches: [ main ] pull_request: +permissions: + contents: read + jobs: build: runs-on: ${{ matrix.os }}