From 06f15ef7547fb21f2ca3109286de254a778f6d96 Mon Sep 17 00:00:00 2001
From: Kevin Minehart <5140827+kminehart@users.noreply.github.com>
Date: Wed, 30 Apr 2025 12:32:44 -0500
Subject: [PATCH] CI: update permissions on workflows which get external
 secrets (#104792)

update permissions
---
 .github/workflows/changelog.yml            | 1 +
 .github/workflows/pr-patch-check-event.yml | 1 +
 .github/workflows/sync-mirror-event.yml    | 1 +
 3 files changed, 3 insertions(+)

diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml
index c2dcc2972f1..8e7fe54f018 100644
--- a/.github/workflows/changelog.yml
+++ b/.github/workflows/changelog.yml
@@ -63,6 +63,7 @@ jobs:
       DRY_RUN: ${{ inputs.dry_run }}
     runs-on: ubuntu-latest
     permissions:
+      id-token: write
       contents: write
       pull-requests: write
     steps:
diff --git a/.github/workflows/pr-patch-check-event.yml b/.github/workflows/pr-patch-check-event.yml
index f7605f033ce..b274b86b87b 100644
--- a/.github/workflows/pr-patch-check-event.yml
+++ b/.github/workflows/pr-patch-check-event.yml
@@ -20,6 +20,7 @@ permissions: {}
 jobs:
   dispatch-job:
     permissions:
+      id-token: write
       contents: read
       actions: write
     env:
diff --git a/.github/workflows/sync-mirror-event.yml b/.github/workflows/sync-mirror-event.yml
index b9387e02069..a23f1e5b096 100644
--- a/.github/workflows/sync-mirror-event.yml
+++ b/.github/workflows/sync-mirror-event.yml
@@ -17,6 +17,7 @@ jobs:
   dispatch-job:
     runs-on: ubuntu-latest
     permissions:
+      id-token: write
       contents: read
       actions: write
     env: