From 3e9d5aab68934d691adb20a8e5dd464d3511ccb7 Mon Sep 17 00:00:00 2001
From: Douglas Eichelberger <doug.eichelberger@gusto.com>
Date: Mon, 17 Aug 2026 12:06:43 -0700
Subject: [PATCH] Add explicit GITHUB_TOKEN permissions to workflows

Resolves the four open `actions/missing-workflow-permissions` CodeQL
alerts by giving every job an explicit, least-privilege permissions
block.

- ci.yml (alerts #3 `lint`, #4 `test`): both jobs only check out the
  repo, install node deps and run yarn lint / compile / xvfb-run yarn
  test. Neither touches the GitHub API, so a single workflow-level
  `contents: read` covers both.
- stale.yml (alert #2): calls shared-config's stale.yml, which runs
  actions/stale to comment on and close stale issues *and* PRs, so the
  caller ceiling must include `issues: write` and `pull-requests:
  write` or the scheduled sweep silently stops closing things.
- triage.yml (alert #1): calls shared-config's triage.yml, which runs
  `gh issue edit --add-label triage`; `issues: write` is all it needs.

codeql.yml already declares its permissions and is left untouched.
---
 .github/workflows/ci.yml     | 3 +++
 .github/workflows/stale.yml  | 3 +++
 .github/workflows/triage.yml | 2 ++
 3 files changed, 8 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9d85c3c..dcfc3f4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,6 +5,9 @@ on:
     branches: [main]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 0287d52..2696450 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -5,4 +5,7 @@ on:
     - cron: '0 0 * * *'
 jobs:
   call-workflow-from-shared-config:
+    permissions:
+      issues: write
+      pull-requests: write
     uses: rubyatscale/shared-config/.github/workflows/stale.yml@main
diff --git a/.github/workflows/triage.yml b/.github/workflows/triage.yml
index 74bb1d9..7c492ee 100644
--- a/.github/workflows/triage.yml
+++ b/.github/workflows/triage.yml
@@ -6,4 +6,6 @@ on:
       - opened
 jobs:
   call-workflow-from-shared-config:
+    permissions:
+      issues: write
     uses: rubyatscale/shared-config/.github/workflows/triage.yml@main