From 9eacf68fa0962189e7905ee468989ac46cbcd241 Mon Sep 17 00:00:00 2001
From: Peter Matkovski <peter.matkovski@getstream.io>
Date: Wed, 8 Jul 2026 13:28:47 +0200
Subject: [PATCH 1/5] CI: add least-privilege permissions to GitHub Actions
 workflows

Add explicit workflow-level permissions blocks to resolve CodeQL
actions/missing-workflow-permissions alerts. Scopes are derived from
workflow operations (git push, artifact upload, Danger, release lanes).

Refs: APPSEC-164
---
 .github/workflows/ci.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 60b336e..2bd9068 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -10,6 +10,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref }}
   cancel-in-progress: true
 
+permissions:
+  actions: write
+  contents: read
+
 jobs:
   basic:
     name: Run tests

From 292a7b1dc06ef4eaeb4463a449c55af23d997637 Mon Sep 17 00:00:00 2001
From: Peter Matkovski <peter.matkovski@getstream.io>
Date: Wed, 8 Jul 2026 13:28:48 +0200
Subject: [PATCH 2/5] CI: add least-privilege permissions to GitHub Actions
 workflows

Add explicit workflow-level permissions blocks to resolve CodeQL
actions/missing-workflow-permissions alerts. Scopes are derived from
workflow operations (git push, artifact upload, Danger, release lanes).

Refs: APPSEC-164
---
 .github/workflows/initiate_release.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/initiate_release.yaml b/.github/workflows/initiate_release.yaml
index 88c7db7..839811e 100755
--- a/.github/workflows/initiate_release.yaml
+++ b/.github/workflows/initiate_release.yaml
@@ -7,6 +7,10 @@ on:
         description: 'The new version number. Example: 1.40.1'
         required: true
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   init_release:
     runs-on: ubuntu-latest

From b9d137d2942f9976c2af6769a75a0975d4dada64 Mon Sep 17 00:00:00 2001
From: Peter Matkovski <peter.matkovski@getstream.io>
Date: Wed, 8 Jul 2026 13:28:49 +0200
Subject: [PATCH 3/5] CI: add least-privilege permissions to GitHub Actions
 workflows

Add explicit workflow-level permissions blocks to resolve CodeQL
actions/missing-workflow-permissions alerts. Scopes are derived from
workflow operations (git push, artifact upload, Danger, release lanes).

Refs: APPSEC-164
---
 .github/workflows/release.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 6646e67..c0f66d6 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -6,6 +6,10 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   Release:
     if: github.event.pull_request.merged && startsWith(github.head_ref, 'release-')

From fa89df90ff3877e57500d17a59a3675257469e8c Mon Sep 17 00:00:00 2001
From: Peter Matkovski <peter.matkovski@getstream.io>
Date: Wed, 8 Jul 2026 13:28:50 +0200
Subject: [PATCH 4/5] CI: add least-privilege permissions to GitHub Actions
 workflows

Add explicit workflow-level permissions blocks to resolve CodeQL
actions/missing-workflow-permissions alerts. Scopes are derived from
workflow operations (git push, artifact upload, Danger, release lanes).

Refs: APPSEC-164
---
 .github/workflows/reviewdog.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/reviewdog.yml b/.github/workflows/reviewdog.yml
index 5674995..bd4a5be 100644
--- a/.github/workflows/reviewdog.yml
+++ b/.github/workflows/reviewdog.yml
@@ -9,6 +9,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   reviewdog:
     runs-on: ubuntu-latest

From 09356ffdf6d4c0e2707246b02c51bbb97cc6795d Mon Sep 17 00:00:00 2001
From: Peter Matkovski <peter.matkovski@getstream.io>
Date: Wed, 8 Jul 2026 13:28:51 +0200
Subject: [PATCH 5/5] CI: add least-privilege permissions to GitHub Actions
 workflows

Add explicit workflow-level permissions blocks to resolve CodeQL
actions/missing-workflow-permissions alerts. Scopes are derived from
workflow operations (git push, artifact upload, Danger, release lanes).

Refs: APPSEC-164
---
 .github/workflows/skip-ci-on-release.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/skip-ci-on-release.yml b/.github/workflows/skip-ci-on-release.yml
index b27bfbc..32f4f02 100644
--- a/.github/workflows/skip-ci-on-release.yml
+++ b/.github/workflows/skip-ci-on-release.yml
@@ -12,6 +12,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   reviewdog:
     runs-on: ubuntu-latest