From 83671ae2d804bf39ef298e4b2cd3e16acf80641d Mon Sep 17 00:00:00 2001
From: Jason Ross <jason.ross841@gmail.com>
Date: Thu, 2 Oct 2025 14:30:27 -0500
Subject: [PATCH] updated permissions in all Github workflows

---
 .github/workflows/branch-protection-config.yml | 1 +
 .github/workflows/ci_cd.yml                    | 4 ++++
 .github/workflows/claude-code-review.yml       | 4 ++++
 .github/workflows/claude.yml                   | 4 ++++
 .github/workflows/release-scrapyard.yml        | 4 ++++
 .github/workflows/release.yml                  | 1 +
 .github/workflows/status-checks.yml            | 1 +
 .github/workflows/sync-wiki.yml                | 1 +
 .github/workflows/test-env-detection.yml       | 4 ++++
 9 files changed, 24 insertions(+)

diff --git a/.github/workflows/branch-protection-config.yml b/.github/workflows/branch-protection-config.yml
index 795ea0c..d587006 100644
--- a/.github/workflows/branch-protection-config.yml
+++ b/.github/workflows/branch-protection-config.yml
@@ -33,6 +33,7 @@ on:
 
 permissions:
   contents: read
+  pull-requests: write
 
 jobs:
   configure-branch-protection:
diff --git a/.github/workflows/ci_cd.yml b/.github/workflows/ci_cd.yml
index bf8e643..65986dc 100644
--- a/.github/workflows/ci_cd.yml
+++ b/.github/workflows/ci_cd.yml
@@ -4,6 +4,10 @@ name: CI/CD Pipeline
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   test:
     runs-on: ${{ matrix.os }}
diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index 31c04fd..206532a 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -10,6 +10,10 @@ on:
     #   - "src/**/*.js"
     #   - "src/**/*.jsx"
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   claude-review:
     # Optional: Filter by PR author
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index b1a3201..4711567 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -10,6 +10,10 @@ on:
   pull_request_review:
     types: [submitted]
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   claude:
     if: |
diff --git a/.github/workflows/release-scrapyard.yml b/.github/workflows/release-scrapyard.yml
index 0e3d596..3132c06 100644
--- a/.github/workflows/release-scrapyard.yml
+++ b/.github/workflows/release-scrapyard.yml
@@ -13,6 +13,10 @@ on:
         default: false
         type: boolean
 
+permissions:
+  contents: read
+  pull-requests: write
+
 env:
   APP_NAME: android-file-handler
   PYTHON_VERSION: "3.12"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 281f5fa..7fe0dfc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,6 +19,7 @@ on:
 
 permissions:
   contents: write
+  pull-requests: write
 
 env:
   # change this if you prefer a different pinned fpm version
diff --git a/.github/workflows/status-checks.yml b/.github/workflows/status-checks.yml
index 8576608..4928195 100644
--- a/.github/workflows/status-checks.yml
+++ b/.github/workflows/status-checks.yml
@@ -9,6 +9,7 @@ on:
 permissions:
   contents: read
   packages: read
+  pull-requests: write
 
 env:
   FPM_VERSION: "1.16.0"
diff --git a/.github/workflows/sync-wiki.yml b/.github/workflows/sync-wiki.yml
index 45db7c5..49c2c8c 100644
--- a/.github/workflows/sync-wiki.yml
+++ b/.github/workflows/sync-wiki.yml
@@ -18,6 +18,7 @@ on:
 
 permissions:
   contents: write
+  pull-requests: write
 
 jobs:
   sync-wiki:
diff --git a/.github/workflows/test-env-detection.yml b/.github/workflows/test-env-detection.yml
index 6484a29..55d2f24 100644
--- a/.github/workflows/test-env-detection.yml
+++ b/.github/workflows/test-env-detection.yml
@@ -7,6 +7,10 @@ on:
         required: true
         default: '0.1.0'
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   test-environment:
     runs-on: ubuntu-latest