From e36d774d0cedbafde726b450c095548496b47080 Mon Sep 17 00:00:00 2001
From: Kevin Minehart <5140827+kminehart@users.noreply.github.com>
Date: Wed, 30 Apr 2025 12:32:44 -0500
Subject: [PATCH] CI: update permissions on workflows which get external
 secrets (#104792)

update permissions
---
 .github/workflows/changelog.yml            | 5 ++---
 .github/workflows/pr-patch-check-event.yml | 5 ++---
 .github/workflows/sync-mirror-event.yml    | 4 ++--
 3 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml
index 4570a13ec13..0d3abeb352f 100644
--- a/.github/workflows/changelog.yml
+++ b/.github/workflows/changelog.yml
@@ -46,9 +46,7 @@ on:
         default: false
         type: boolean
 
-permissions:
-  contents: read
-  id-token: write
+permissions: {}
 
 jobs:
   main:
@@ -60,6 +58,7 @@ jobs:
       DRY_RUN: ${{ inputs.dry_run }}
     runs-on: ubuntu-latest
     permissions:
+      id-token: write
       contents: write
       pull-requests: write
     steps:
diff --git a/.github/workflows/pr-patch-check-event.yml b/.github/workflows/pr-patch-check-event.yml
index d16e6580c51..19264f5ada0 100644
--- a/.github/workflows/pr-patch-check-event.yml
+++ b/.github/workflows/pr-patch-check-event.yml
@@ -13,15 +13,14 @@ on:
       - "v*.*.*"
       - "release-*"
 
-permissions:
-  contents: read
-  id-token: write
+permissions: {}
 
 # Since this is run on a pull request, we want to apply the patches intended for the
 # target branch onto the source branch, to verify compatibility before merging.
 jobs:
   dispatch-job:
     permissions:
+      id-token: write
       contents: read
       actions: write
     env:
diff --git a/.github/workflows/sync-mirror-event.yml b/.github/workflows/sync-mirror-event.yml
index 13c9563846a..4a073c9b2b3 100644
--- a/.github/workflows/sync-mirror-event.yml
+++ b/.github/workflows/sync-mirror-event.yml
@@ -10,14 +10,14 @@ on:
       - "v*.*.*"
       - "release-*"
 
-permissions:
-  id-token: write
+permissions: {}
 
 # This is run after the pull request has been merged, so we'll run against the target branch
 jobs:
   dispatch-job:
     runs-on: ubuntu-latest
     permissions:
+      id-token: write
       contents: read
       actions: write
     env: