From 4c29eb7815e0b8020cd6546431dbf6d8e90bf7e0 Mon Sep 17 00:00:00 2001
From: Amit <amitmehra7470@gmail.com>
Date: Mon, 8 Jun 2026 01:48:03 +0530
Subject: [PATCH] ci: add explicit permissions to release workflows

Adds top-level permissions blocks to prep-release.yml,
publish-changelog.yml, and publish-release.yml, which were
missing explicit permissions and defaulting to read-write.

Part of improving OpenSSF Scorecard Token-Permissions score.
Relates to #7941
---
 .github/workflows/prep-release.yml      | 4 ++++
 .github/workflows/publish-changelog.yml | 4 ++++
 .github/workflows/publish-release.yml   | 3 +++
 3 files changed, 11 insertions(+)

diff --git a/.github/workflows/prep-release.yml b/.github/workflows/prep-release.yml
index e4107cf9916..65bc1428786 100644
--- a/.github/workflows/prep-release.yml
+++ b/.github/workflows/prep-release.yml
@@ -23,6 +23,10 @@ on:
         description: "Use PRs with activity since the last stable git tag"
         required: false
         type: boolean
+
+permissions:
+    contents: read
+
 jobs:
   prep_release:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/publish-changelog.yml b/.github/workflows/publish-changelog.yml
index 2a68ad9e196..5b97ad2fcbd 100644
--- a/.github/workflows/publish-changelog.yml
+++ b/.github/workflows/publish-changelog.yml
@@ -9,6 +9,10 @@ on:
         description: "The branch to target"
         required: false
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   publish_changelog:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
index f2e2f207841..6e6e77cba3d 100644
--- a/.github/workflows/publish-release.yml
+++ b/.github/workflows/publish-release.yml
@@ -12,6 +12,9 @@ on:
         description: "Comma separated list of steps to skip"
         required: false
 
+permissions:
+  contents: read
+
 jobs:
   publish_release:
     runs-on: ubuntu-latest