From 062513494e07ae5d3b8d72057d2a1b6afecfb125 Mon Sep 17 00:00:00 2001
From: rreddy <rreddy@newrelic.com>
Date: Wed, 5 Aug 2026 22:16:35 +0530
Subject: [PATCH 1/2] add permissions to GitHub Actions workflows

---
 .github/workflows/automated_release.yaml | 3 +++
 .github/workflows/on_prerelease.yaml     | 3 +++
 .github/workflows/on_push_pr.yaml        | 3 +++
 .github/workflows/on_release.yaml        | 3 +++
 .github/workflows/repolinter.yml         | 3 +++
 .github/workflows/security.yaml          | 4 ++++
 6 files changed, 19 insertions(+)

diff --git a/.github/workflows/automated_release.yaml b/.github/workflows/automated_release.yaml
index a4d01159..2b4fc56e 100644
--- a/.github/workflows/automated_release.yaml
+++ b/.github/workflows/automated_release.yaml
@@ -5,6 +5,9 @@ on:
   schedule:
     - cron: "0 15 * * 1"
 
+permissions:
+  contents: write
+
 jobs:
   release_management:
     uses: newrelic/coreint-automation/.github/workflows/reusable_release_automation.yaml@v3
diff --git a/.github/workflows/on_prerelease.yaml b/.github/workflows/on_prerelease.yaml
index ea066b7b..15f01fc9 100644
--- a/.github/workflows/on_prerelease.yaml
+++ b/.github/workflows/on_prerelease.yaml
@@ -7,6 +7,9 @@ on:
     tags:
       - 'v*'
 
+permissions:
+  contents: write
+
 jobs:
   pre-release:
     uses: newrelic/coreint-automation/.github/workflows/reusable_pre_release.yaml@v3
diff --git a/.github/workflows/on_push_pr.yaml b/.github/workflows/on_push_pr.yaml
index 84b0a2e9..ac1b7e43 100644
--- a/.github/workflows/on_push_pr.yaml
+++ b/.github/workflows/on_push_pr.yaml
@@ -9,6 +9,9 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   push-pr:
     uses: newrelic/coreint-automation/.github/workflows/reusable_push_pr.yaml@v3
diff --git a/.github/workflows/on_release.yaml b/.github/workflows/on_release.yaml
index 2f3f28d7..bf4015cf 100644
--- a/.github/workflows/on_release.yaml
+++ b/.github/workflows/on_release.yaml
@@ -7,6 +7,9 @@ on:
     tags:
       - 'v*'
 
+permissions:
+  contents: read
+
 jobs:
   release:
     uses: newrelic/coreint-automation/.github/workflows/reusable_on_release.yaml@v3
diff --git a/.github/workflows/repolinter.yml b/.github/workflows/repolinter.yml
index 6ca54d4b..b06b6514 100644
--- a/.github/workflows/repolinter.yml
+++ b/.github/workflows/repolinter.yml
@@ -6,6 +6,9 @@ on:
   push:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   repolinter:
     uses: newrelic/coreint-automation/.github/workflows/reusable_repolinter.yaml@v3
diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml
index 049282aa..7f630b59 100644
--- a/.github/workflows/security.yaml
+++ b/.github/workflows/security.yaml
@@ -10,6 +10,10 @@ on:
   schedule:
     - cron: "0 3 * * *"
 
+permissions:
+  contents: read
+  security-events: write
+
 jobs:
   security:
     uses: newrelic/coreint-automation/.github/workflows/reusable_security.yaml@v3

From d6a021647f28d51b104130ba9f6141f503259402 Mon Sep 17 00:00:00 2001
From: rreddy <rreddy@newrelic.com>
Date: Thu, 6 Aug 2026 11:38:32 +0530
Subject: [PATCH 2/2] update changelog file

---
 CHANGELOG.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0f7bc9d7..eb082b28 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,9 @@ Unreleased section should follow [Release Toolkit](https://github.com/newrelic/r
 
 ## Unreleased
 
+### Security
+- Added explicit least-privilege `permissions` blocks to GitHub Actions workflows
+
 ## v2.29.0 - 2026-07-13
 
 ### 🛡️ Security notices