From 45d6b59a18c1061272e7ed7a51a97e6c17298cbd Mon Sep 17 00:00:00 2001 From: Yordis Prieto Date: Tue, 15 Sep 2026 16:08:21 -0400 Subject: [PATCH] ci: ask for the token scopes these two workflows rely on Both take their write access from the organization default rather than declaring it, which is the only thing keeping that default at write for every other job in the organization that never needed it. Signed-off-by: Yordis Prieto --- .github/workflows/cherry-pick-pr-for-label.yml | 5 +++++ .github/workflows/license.yml | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/.github/workflows/cherry-pick-pr-for-label.yml b/.github/workflows/cherry-pick-pr-for-label.yml index 2b94498f4..81a31dc5d 100644 --- a/.github/workflows/cherry-pick-pr-for-label.yml +++ b/.github/workflows/cherry-pick-pr-for-label.yml @@ -2,10 +2,15 @@ name: Cherry pick PR commits for label on: pull_request_target: types: [closed] +permissions: {} + jobs: cherry_pick_pr_for_label: name: Cherry pick PR commits for label runs-on: ubuntu-latest + permissions: + contents: write + pull-requests: write steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Cherry Pick PR for label diff --git a/.github/workflows/license.yml b/.github/workflows/license.yml index 6eea75c20..165b044ba 100644 --- a/.github/workflows/license.yml +++ b/.github/workflows/license.yml @@ -5,9 +5,14 @@ on: - cron: "0 3 1 1 *" workflow_dispatch: +permissions: {} + jobs: run: runs-on: ubuntu-latest + permissions: + contents: write + pull-requests: write steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: