From 4cc2de15bbe2de18f1675d90fd489c222631588c Mon Sep 17 00:00:00 2001
From: rreddy <rreddy@newrelic.com>
Date: Wed, 5 Aug 2026 21:19:53 +0530
Subject: [PATCH 1/4] fix(workflows): add explicit permissions to GitHub
 Actions workflows

---
 .github/workflows/automated_release.yaml | 3 +++
 .github/workflows/on_prerelease.yaml     | 3 +++
 .github/workflows/on_push_pr.yaml        | 3 +++
 .github/workflows/on_release.yaml        | 3 +++
 .github/workflows/repolinter.yml         | 3 +++
 .github/workflows/security.yaml          | 4 ++++
 6 files changed, 19 insertions(+)

diff --git a/.github/workflows/automated_release.yaml b/.github/workflows/automated_release.yaml
index a38e0e71..b71b7032 100644
--- a/.github/workflows/automated_release.yaml
+++ b/.github/workflows/automated_release.yaml
@@ -5,6 +5,9 @@ on:
   schedule:
     - cron: "30 5 * * 1"
 
+permissions:
+  contents: read
+
 jobs:
   release_management:
     uses: newrelic/coreint-automation/.github/workflows/reusable_release_automation.yaml@v3
diff --git a/.github/workflows/on_prerelease.yaml b/.github/workflows/on_prerelease.yaml
index e461a702..3ee5e0b8 100644
--- a/.github/workflows/on_prerelease.yaml
+++ b/.github/workflows/on_prerelease.yaml
@@ -6,6 +6,9 @@ on:
     tags:
       - 'v*'
 
+permissions:
+  contents: write
+
 jobs:
   pre-release:
     uses: newrelic/coreint-automation/.github/workflows/reusable_pre_release.yaml@v3
diff --git a/.github/workflows/on_push_pr.yaml b/.github/workflows/on_push_pr.yaml
index f9003b19..c8eab14b 100644
--- a/.github/workflows/on_push_pr.yaml
+++ b/.github/workflows/on_push_pr.yaml
@@ -7,6 +7,9 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   push-pr:
     uses: newrelic/coreint-automation/.github/workflows/reusable_push_pr.yaml@v3
diff --git a/.github/workflows/on_release.yaml b/.github/workflows/on_release.yaml
index 169d3a2f..d56315bb 100644
--- a/.github/workflows/on_release.yaml
+++ b/.github/workflows/on_release.yaml
@@ -7,6 +7,9 @@ on:
     tags:
       - 'v*'
 
+permissions:
+  contents: read
+
 jobs:
   release:
     uses: newrelic/coreint-automation/.github/workflows/reusable_on_release.yaml@v3
diff --git a/.github/workflows/repolinter.yml b/.github/workflows/repolinter.yml
index 6ca54d4b..b06b6514 100644
--- a/.github/workflows/repolinter.yml
+++ b/.github/workflows/repolinter.yml
@@ -6,6 +6,9 @@ on:
   push:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   repolinter:
     uses: newrelic/coreint-automation/.github/workflows/reusable_repolinter.yaml@v3
diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml
index 049282aa..7f630b59 100644
--- a/.github/workflows/security.yaml
+++ b/.github/workflows/security.yaml
@@ -10,6 +10,10 @@ on:
   schedule:
     - cron: "0 3 * * *"
 
+permissions:
+  contents: read
+  security-events: write
+
 jobs:
   security:
     uses: newrelic/coreint-automation/.github/workflows/reusable_security.yaml@v3

From f671078961c8ced8353fec5aa0fd1d0edcd0130b Mon Sep 17 00:00:00 2001
From: RamanaReddy8801 <106150577+RamanaReddy8801@users.noreply.github.com>
Date: Thu, 6 Aug 2026 11:03:11 +0530
Subject: [PATCH 2/4] Update automated_release.yaml

---
 .github/workflows/automated_release.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/automated_release.yaml b/.github/workflows/automated_release.yaml
index b71b7032..d82b7d9d 100644
--- a/.github/workflows/automated_release.yaml
+++ b/.github/workflows/automated_release.yaml
@@ -6,7 +6,7 @@ on:
     - cron: "30 5 * * 1"
 
 permissions:
-  contents: read
+  contents: write
 
 jobs:
   release_management:

From 240bf7cb348a19a15c9c844b51d397facce9b6c1 Mon Sep 17 00:00:00 2001
From: rreddy <rreddy@newrelic.com>
Date: Thu, 6 Aug 2026 11:38:03 +0530
Subject: [PATCH 3/4] update changelog file

---
 CHANGELOG.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6daa4ae1..78277f60 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,9 @@ Unreleased section should follow [Release Toolkit](https://github.com/newrelic/r
 
 ## Unreleased
 
+### Security
+- Added explicit least-privilege `permissions` blocks to GitHub Actions workflows
+
 ## v1.23.2 - 2026-07-13
 
 ### ⛓️ Dependencies

From 27654d1426b7c4899dab6af7b2cc7849846dc4f8 Mon Sep 17 00:00:00 2001
From: RamanaReddy8801 <106150577+RamanaReddy8801@users.noreply.github.com>
Date: Mon, 10 Aug 2026 10:40:36 +0530
Subject: [PATCH 4/4] Update security.yaml

---
 .github/workflows/security.yaml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml
index 7f630b59..c3f3de8c 100644
--- a/.github/workflows/security.yaml
+++ b/.github/workflows/security.yaml
@@ -12,7 +12,6 @@ on:
 
 permissions:
   contents: read
-  security-events: write
 
 jobs:
   security: