From f81d3ca909a993c56dd8e52bee433816b78e46bc Mon Sep 17 00:00:00 2001
From: Stacey Van Herk <13419300+svanherk@users.noreply.github.com>
Date: Mon, 21 Sep 2026 15:57:53 -0400
Subject: [PATCH] GAUD-10637 - Add workflow permissions

---
 .github/workflows/ci.yml                  | 4 ++++
 .github/workflows/release.yml             | 4 ++++
 .github/workflows/update-package-lock.yml | 4 ++++
 3 files changed, 12 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1b561d0..ea8b160 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,5 +1,9 @@
 name: CI
 on: pull_request
+
+permissions:
+  contents: read
+
 jobs:
   test:
     timeout-minutes: 5
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8c64450..14af7ca 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -3,6 +3,10 @@ on:
   push:
     branches:
       - main
+
+permissions:
+  contents: read
+
 jobs:
   release:
     if: "!contains(github.event.head_commit.message, 'skip ci')"
diff --git a/.github/workflows/update-package-lock.yml b/.github/workflows/update-package-lock.yml
index c859ecd..cb2522b 100644
--- a/.github/workflows/update-package-lock.yml
+++ b/.github/workflows/update-package-lock.yml
@@ -3,6 +3,10 @@ on:
   schedule:
     - cron: "30 12 * * 2" # Tue 8:30AM EDT. 7:30AM EST.
   workflow_dispatch: # manual trigger
+
+permissions:
+  pull-requests: write
+
 jobs:
   update:
     name: Update