From 17c055165151d681e27c16483c36d502fa2e0a07 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fredrik=20Adel=C3=B6w?= <freben@gmail.com>
Date: Tue, 12 May 2026 19:59:05 +0200
Subject: [PATCH] ci: add explicit permissions to pull_request_target workflows
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add least-privilege permissions blocks to three workflows that use
pull_request_target without explicit permission scoping:

- sync_renovate-changesets: contents:write + pull-requests:write
- sync_dependabot-changesets: contents:write + pull-requests:write
- sync_pull-requests-trigger: all none (only uploads artifacts)

These workflows run in the base repo context and have access to secrets.
Explicit permissions ensure the GITHUB_TOKEN is scoped to only what each
workflow needs, reducing blast radius if a guard is ever bypassed.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
---
 .github/workflows/sync_dependabot-changesets.yml | 4 ++++
 .github/workflows/sync_pull-requests-trigger.yml | 5 +++++
 .github/workflows/sync_renovate-changesets.yml   | 4 ++++
 3 files changed, 13 insertions(+)

diff --git a/.github/workflows/sync_dependabot-changesets.yml b/.github/workflows/sync_dependabot-changesets.yml
index 2b1dd1098f..805ac462ee 100644
--- a/.github/workflows/sync_dependabot-changesets.yml
+++ b/.github/workflows/sync_dependabot-changesets.yml
@@ -5,6 +5,10 @@ on:
       - '.github/workflows/sync_dependabot-changesets.yml'
       - '**/yarn.lock'
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   generate-changeset:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/sync_pull-requests-trigger.yml b/.github/workflows/sync_pull-requests-trigger.yml
index fe87517bd1..906cb45679 100644
--- a/.github/workflows/sync_pull-requests-trigger.yml
+++ b/.github/workflows/sync_pull-requests-trigger.yml
@@ -16,6 +16,11 @@ on:
   issue_comment:
     types: [created]
 
+permissions:
+  actions: none
+  contents: none
+  pull-requests: none
+
 jobs:
   trigger:
     if: >
diff --git a/.github/workflows/sync_renovate-changesets.yml b/.github/workflows/sync_renovate-changesets.yml
index 04495e606b..65312b6f64 100644
--- a/.github/workflows/sync_renovate-changesets.yml
+++ b/.github/workflows/sync_renovate-changesets.yml
@@ -5,6 +5,10 @@ on:
       - '.github/workflows/sync_renovate-changesets.yml'
       - '**/yarn.lock'
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   generate-changeset:
     runs-on: ubuntu-latest