From 8f9ae88fa453be8119e6f6634000f7ac07d0b7b1 Mon Sep 17 00:00:00 2001
From: Stacey Van Herk <13419300+svanherk@users.noreply.github.com>
Date: Wed, 23 Sep 2026 14:17:57 -0400
Subject: [PATCH] GAUD-10637 - Add workflow permissions

---
 .github/workflows/ci.yml                                   | 4 ++++
 .github/workflows/release.yml                              | 4 ++++
 .../static/.github/workflows/update-package-lock.yml       | 4 ++++
 .../release/templates/static/.github/workflows/release.yml | 4 ++++
 .../static-site/templates/.github/workflows/publish.yml    | 4 ++++
 .../static/.github/workflows/ci-test-reporting.yml         | 4 ++++
 .../templates/static/.github/workflows/ci.yml              | 4 ++++
 .../static/.github/workflows/vdiff-test-reporting.yml      | 7 +++++++
 .../templates/static/.github/workflows/vdiff.yml           | 7 +++++++
 9 files changed, 42 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 02a2692..203a63d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,5 +1,9 @@
 name: CI
 on: pull_request
+
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index dd628f6..00dc764 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,6 +5,10 @@ on:
       - main
       - '[0-9]+.x'
       - '[0-9]+.[0-9]+.x'
+
+permissions:
+  contents: read
+
 jobs:
   release:
     name: Release
diff --git a/src/generators/default-content/templates/static/.github/workflows/update-package-lock.yml b/src/generators/default-content/templates/static/.github/workflows/update-package-lock.yml
index 91558e6..d9fc379 100644
--- a/src/generators/default-content/templates/static/.github/workflows/update-package-lock.yml
+++ b/src/generators/default-content/templates/static/.github/workflows/update-package-lock.yml
@@ -3,6 +3,10 @@ on:
   schedule:
     - cron: "30 12 * * 1-5" # Mon-Fri 8:30AM EDT. 7:30AM EST.
   workflow_dispatch: # manual trigger
+
+permissions:
+  pull-requests: write
+
 jobs:
   update:
     name: Update
diff --git a/src/generators/release/templates/static/.github/workflows/release.yml b/src/generators/release/templates/static/.github/workflows/release.yml
index 2c8bc4a..cd11a4b 100644
--- a/src/generators/release/templates/static/.github/workflows/release.yml
+++ b/src/generators/release/templates/static/.github/workflows/release.yml
@@ -5,6 +5,10 @@ on:
       - main
       - '[0-9]+.x'
       - '[0-9]+.[0-9]+.x'
+
+permissions:
+  contents: read
+
 jobs:
   release:
     name: Release
diff --git a/src/generators/static-site/templates/.github/workflows/publish.yml b/src/generators/static-site/templates/.github/workflows/publish.yml
index c49595b..5cf898f 100644
--- a/src/generators/static-site/templates/.github/workflows/publish.yml
+++ b/src/generators/static-site/templates/.github/workflows/publish.yml
@@ -5,6 +5,10 @@ on:
       - main
       - '[0-9]+.x'
       - '[0-9]+.[0-9]+.x'
+
+permissions:
+  contents: read
+
 jobs:
   publish:
     name: Publish
diff --git a/src/generators/test-unit-axe/templates/static/.github/workflows/ci-test-reporting.yml b/src/generators/test-unit-axe/templates/static/.github/workflows/ci-test-reporting.yml
index 130d122..5556c69 100644
--- a/src/generators/test-unit-axe/templates/static/.github/workflows/ci-test-reporting.yml
+++ b/src/generators/test-unit-axe/templates/static/.github/workflows/ci-test-reporting.yml
@@ -1,5 +1,9 @@
 name: CI
 on: pull_request
+
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test
diff --git a/src/generators/test-unit-axe/templates/static/.github/workflows/ci.yml b/src/generators/test-unit-axe/templates/static/.github/workflows/ci.yml
index a39b5d0..cadd409 100644
--- a/src/generators/test-unit-axe/templates/static/.github/workflows/ci.yml
+++ b/src/generators/test-unit-axe/templates/static/.github/workflows/ci.yml
@@ -1,5 +1,9 @@
 name: CI
 on: pull_request
+
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test
diff --git a/src/generators/test-vdiff/templates/static/.github/workflows/vdiff-test-reporting.yml b/src/generators/test-vdiff/templates/static/.github/workflows/vdiff-test-reporting.yml
index f322249..bc8df60 100644
--- a/src/generators/test-vdiff/templates/static/.github/workflows/vdiff-test-reporting.yml
+++ b/src/generators/test-vdiff/templates/static/.github/workflows/vdiff-test-reporting.yml
@@ -1,5 +1,12 @@
 name: vdiff
 on: pull_request
+
+permissions:
+  actions: read
+  contents: write
+  pull-requests: write
+  statuses: write
+
 jobs:
   vdiff:
     timeout-minutes: 5
diff --git a/src/generators/test-vdiff/templates/static/.github/workflows/vdiff.yml b/src/generators/test-vdiff/templates/static/.github/workflows/vdiff.yml
index 33d4e9f..c094217 100644
--- a/src/generators/test-vdiff/templates/static/.github/workflows/vdiff.yml
+++ b/src/generators/test-vdiff/templates/static/.github/workflows/vdiff.yml
@@ -1,5 +1,12 @@
 name: vdiff
 on: pull_request
+
+permissions:
+  actions: read
+  contents: write
+  pull-requests: write
+  statuses: write
+
 jobs:
   vdiff:
     timeout-minutes: 5