From 8cf1318822c036907f582291df5d8aa03575c0e3 Mon Sep 17 00:00:00 2001 From: Adnan Khan Date: Tue, 21 Oct 2025 16:57:17 -0400 Subject: [PATCH 1/2] ci: scope down permissions for gradle.yml --- .github/workflows/gradle.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml index 5c8ad26c..b24ff6fc 100644 --- a/.github/workflows/gradle.yml +++ b/.github/workflows/gradle.yml @@ -37,6 +37,9 @@ on: required: false default: false +permissions: + contents: write + jobs: build: env: From 709f2fb593cf85da897c4683db90524918702091 Mon Sep 17 00:00:00 2001 From: Adnan Khan Date: Tue, 21 Oct 2025 16:57:18 -0400 Subject: [PATCH 2/2] ci: scope down permissions for remove-old-artifacts.yml --- .github/workflows/remove-old-artifacts.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/remove-old-artifacts.yml b/.github/workflows/remove-old-artifacts.yml index 45964b29..79b96802 100644 --- a/.github/workflows/remove-old-artifacts.yml +++ b/.github/workflows/remove-old-artifacts.yml @@ -20,6 +20,9 @@ on: # Every day at 1am - cron: '0 1 * * *' +permissions: + actions: write + jobs: remove-old-artifacts: runs-on: ubuntu-latest