[ci] Tighten workflow permissions to least-privilege (#16349)

This commit is contained in:
Jesse Hills
2026-05-11 17:15:53 +12:00
committed by GitHub
parent 5dadfe6367
commit fe66f9ba41
16 changed files with 57 additions and 44 deletions
@@ -15,9 +15,9 @@ on:
- beta
permissions:
issues: write
pull-requests: read
contents: read
issues: write # issues.addLabels / removeLabel to manage the 'code-owner-approved' label on the PR
pull-requests: read # listReviews to determine whether a codeowner has approved
contents: read # actions/checkout to read CODEOWNERS and the shared codeowners.js helper
jobs:
codeowner-approved: