From 6d9bd9ff7ab2aa96a2c3c0f76aef29ff53f07dc7 Mon Sep 17 00:00:00 2001
From: goelakash <goelakash93@gmail.com>
Date: Thu, 4 Jun 2026 19:14:37 -0700
Subject: [PATCH] Add top-level permissions blocks to release workflows

The three release workflows (prep-release, publish-release,
publish-changelog) had no top-level permissions block, so jobs
inherited the broad workflow default. Adds an explicit
top-level `permissions: contents: read` (least-privilege default),
and a job-level read in publish-changelog since the actual write
goes through the GitHub App token, not GITHUB_TOKEN.

Improves the OpenSSF Scorecard Token-Permissions check, currently
0/10 (https://scorecard.dev/viewer/?uri=github.com%2Fjupyter%2Fnotebook).

Refs #7941
---
 .github/workflows/prep-release.yml      | 4 ++++
 .github/workflows/publish-changelog.yml | 5 +++++
 .github/workflows/publish-release.yml   | 3 +++
 3 files changed, 12 insertions(+)

diff --git a/.github/workflows/prep-release.yml b/.github/workflows/prep-release.yml
index e4107cf9916..ea4062fbd90 100644
--- a/.github/workflows/prep-release.yml
+++ b/.github/workflows/prep-release.yml
@@ -23,6 +23,10 @@ on:
         description: "Use PRs with activity since the last stable git tag"
         required: false
         type: boolean
+
+permissions:
+  contents: read
+
 jobs:
   prep_release:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/publish-changelog.yml b/.github/workflows/publish-changelog.yml
index 2a68ad9e196..6085c91dbd0 100644
--- a/.github/workflows/publish-changelog.yml
+++ b/.github/workflows/publish-changelog.yml
@@ -9,10 +9,15 @@ on:
         description: "The branch to target"
         required: false
 
+permissions:
+  contents: read
+
 jobs:
   publish_changelog:
     runs-on: ubuntu-latest
     environment: release
+    permissions:
+      contents: read
     steps:
       - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@95d85449e4f3f352e261221f6529f8ed307f5728 # v1
 
diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
index f2e2f207841..6e6e77cba3d 100644
--- a/.github/workflows/publish-release.yml
+++ b/.github/workflows/publish-release.yml
@@ -12,6 +12,9 @@ on:
         description: "Comma separated list of steps to skip"
         required: false
 
+permissions:
+  contents: read
+
 jobs:
   publish_release:
     runs-on: ubuntu-latest