Declare GITHUB_TOKEN permissions for workflows that write to the repo

.github/workflows/check_approvals.yml

@@ -12,6 +12,9 @@ jobs:
     runs-on: ubuntu-latest
     # Skip draft PRs.
     if: github.event.pull_request.draft == false && github.repository_owner == 'warpdotdev'
+    permissions:
+      contents: read # actions/checkout clones the repo so the script can read OWNERS and diff the changed files
+      pull-requests: write # `gh pr view` reads the PR's reviews, and `gh pr comment` posts the list of missing approvals
     steps:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

.github/workflows/ci.yml

@@ -51,6 +51,9 @@ jobs:
       github.event.pull_request.draft == false &&
       (!startsWith(github.event.pull_request.head.ref, 'repo-sync/') || contains(github.event.pull_request.labels.*.name, 'repo-sync:conflict')) &&
       github.repository_owner == 'warpdotdev'
+    permissions:
+      contents: read # actions/checkout clones the repo
+      pull-requests: read # dorny/paths-filter asks the GitHub API for the PR's changed-files list to decide which CI jobs run; reading PR metadata needs this scope
     outputs:
       affects-database-schema: ${{ github.ref == 'master' || steps.filter.outputs.affects-database-schema }}
       affects-rust-sources: ${{ github.ref == 'master' || steps.filter.outputs.affects-rust-sources }}

.github/workflows/create_release.yml

@@ -57,6 +57,9 @@ on:
         type: boolean
         default: true
 
+permissions:
+  contents: write # script/create_release_tag_and_branch pushes the release branch and tag; softprops/action-gh-release creates the GitHub release; each build job runs `gh release upload` to attach its artifacts
+
 env:
   CARGO_TERM_COLOR: always
   CONFIG_FILE: ".github/workflows/release_configurations.json"

.github/workflows/cut_new_release_candidate.yml

@@ -34,6 +34,8 @@ jobs:
   create_release_candidate:
     name: Create Release Candidate
     uses: ./.github/workflows/create_release.yml
+    permissions:
+      contents: write # create_release.yml pushes the release branch/tag and creates and uploads the GitHub release; a reusable-workflow caller must grant everything its callee declares
     needs: compute_channel
     with:
       channel: ${{ needs.compute_channel.outputs.channel }}

.github/workflows/cut_new_releases.yml

@@ -71,6 +71,8 @@ jobs:
   create_release:
     name: Create Release
     uses: ./.github/workflows/create_release.yml
+    permissions:
+      contents: write # create_release.yml pushes the release branch/tag and creates and uploads the GitHub release; a reusable-workflow caller must grant everything its callee declares
     needs: get_config
     strategy:
       fail-fast: false

.github/workflows/delete_release.yml

@@ -26,6 +26,8 @@ jobs:
   delete_release:
     name: Delete Release Branch
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # `git push` renames the release branch to deleted/<branch> and deletes the original
     steps:
       - name: Verify confirmation
         run: |

.github/workflows/populate_build_cache.yml

@@ -24,4 +24,8 @@ jobs:
     name: CI
     if: github.repository_owner == 'warpdotdev'
     uses: ./.github/workflows/ci.yml
+    permissions:
+      contents: read # ci.yml jobs clone the repo
+      id-token: write # ci.yml's tests jobs mint an OIDC token to authenticate to GCP
+      pull-requests: read # ci.yml's params job reads the PR changed-files list; a reusable-workflow caller must grant everything its callee's jobs declare
     secrets: inherit

.github/workflows/repo-sync.yml

@@ -38,6 +38,9 @@ jobs:
       ) &&
       github.repository_owner == 'warpdotdev'
     uses: warpdotdev/repo-sync/.github/workflows/restack.yml@main
+    permissions:
+      contents: write # repo-sync's restack workflow rebases and force-pushes the sync branches
+      pull-requests: write # it retargets the sync PRs and enables auto-merge on them
     with:
       repo_sync_ref: main
       app_id: ${{ vars.REPO_SYNC_APP_ID }}
@@ -54,6 +57,9 @@ jobs:
       startsWith(github.event.pull_request.head.ref, 'repo-sync/') &&
       github.repository_owner == 'warpdotdev'
     uses: warpdotdev/repo-sync/.github/workflows/approve.yml@main
+    permissions:
+      contents: write # repo-sync's approve workflow pushes conflict resolutions to the sync branch
+      pull-requests: write # it approves the sync PR and enables auto-merge
     with:
       repo_sync_ref: main
       approver_app_id: ${{ vars.REPO_SYNC_APPROVER_APP_ID }}
@@ -65,6 +71,10 @@ jobs:
   escalation:
     if: inputs.action == 'escalation' && github.repository_owner == 'warpdotdev'
     uses: warpdotdev/repo-sync/.github/workflows/escalation.yml@main
+    permissions:
+      actions: write # repo-sync's escalation workflow re-dispatches the restack workflow for stuck sync stacks
+      contents: read # it clones the repo to inspect the stack
+      pull-requests: write # it requests reviewers and disables auto-merge on the stuck sync PRs
     with:
       repo_sync_ref: main
       app_id: ${{ vars.REPO_SYNC_APP_ID }}