.github/workflows/branch-protection-config.yml

@@ -33,6 +33,7 @@ on:
 
 permissions:
   contents: read
+  pull-requests: write
 
 jobs:
   configure-branch-protection:

.github/workflows/ci_cd.yml

@@ -4,6 +4,10 @@ name: CI/CD Pipeline
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   test:
     runs-on: ${{ matrix.os }}

.github/workflows/claude-code-review.yml

@@ -10,6 +10,10 @@ on:
     #   - "src/**/*.js"
     #   - "src/**/*.jsx"
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   claude-review:
     # Optional: Filter by PR author

.github/workflows/claude.yml

@@ -10,6 +10,10 @@ on:
   pull_request_review:
     types: [submitted]
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   claude:
     if: |

.github/workflows/release-scrapyard.yml

@@ -13,6 +13,10 @@ on:
         default: false
         type: boolean
 
+permissions:
+  contents: read
+  pull-requests: write
+
 env:
   APP_NAME: android-file-handler
   PYTHON_VERSION: "3.12"

.github/workflows/release.yml

@@ -19,6 +19,7 @@ on:
 
 permissions:
   contents: write
+  pull-requests: write
 
 env:
   # change this if you prefer a different pinned fpm version

.github/workflows/status-checks.yml

@@ -9,6 +9,7 @@ on:
 permissions:
   contents: read
   packages: read
+  pull-requests: write
 
 env:
   FPM_VERSION: "1.16.0"

.github/workflows/sync-wiki.yml

@@ -18,6 +18,7 @@ on:
 
 permissions:
   contents: write
+  pull-requests: write
 
 jobs:
   sync-wiki:

.github/workflows/test-env-detection.yml

@@ -7,6 +7,10 @@ on:
         required: true
         default: '0.1.0'
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   test-environment:
     runs-on: ubuntu-latest