[harryalbert]

Why

The warpdotdev enterprise default for GITHUB_TOKEN is moving to read-only (contents: read, packages: read, metadata: read). Workflows that comment on PRs, push branches/tags, create releases, or call reusable workflows requesting broader scopes need explicit grants, or they fail (reusable-workflow callers fail at run start). This adds the minimal permissions: blocks, with a comment on each scope saying which step uses it.

Changes

• ci.yml: params job gets contents: read (checkout) and pull-requests: read (dorny/paths-filter lists PR files via the API). This job gates the required Check CI results check. The other jobs only use GITHUB_TOKEN for API rate limiting or already declare permissions.
• populate_build_cache.yml: the caller of ci.yml grants contents: read, id-token: write (tests jobs use GCP WIF), and pull-requests: read (params job). These are the scopes the callee's jobs request.
• create_release.yml: workflow-level contents: write covers the release branch/tag push (checkout-persisted token), softprops/action-gh-release, and the gh release upload steps.
• cut_new_releases.yml / cut_new_release_candidate.yml: the create_release.yml callers grant contents: write.
• delete_release.yml: contents: write so the job can push deleted/<branch> and delete the original branch.
• check_approvals.yml: contents: read (checkout) and pull-requests: write (gh pr view reviews, gh pr comment).
• repo-sync.yml: restack/approve callers grant contents: write and pull-requests: write. The escalation caller grants actions: write, contents: read, and pull-requests: write. These match the scopes the warpdotdev/repo-sync callee jobs declare.

Of the 23 workflow files, 22 are byte-identical to the public warp repo (ci.yml differs only by private repo-sync markers). Repo-sync will carry these changes there.

actionlint: no new findings (126 pre-existing before and after).

CHANGELOG-NONE

Co-Authored-By: Warp agent@warp.dev

• close_stale_fix_prs.yml, warp_cleanup_fix_prs.yml: deleted. Both clean up PRs created by the oz-agent-action "Fix Failing Checks" workflow (oz-agent-fix/run-* branches, auto-fix-ci label), which this repo no longer runs. There are no open or recently closed PRs matching either, so the daily job has been a no-op. Deleting them instead of granting pull-requests: write to dead code.

[warp-local-for-testing-only]

@harryalbert, your GitHub account is not connected to Warp. Connect your GitHub account.