From 00d1ae304724525c3977c777aaf063695ca531e4 Mon Sep 17 00:00:00 2001
From: Michael Johansen <michael.johansen@emerson.com>
Date: Thu, 15 Oct 2026 11:06:13 -0500
Subject: [PATCH 1/3] Add default permissions to workflow files

Signed-off-by: Michael Johansen <michael.johansen@emerson.com>
---
 .github/workflows/CI.yml                         | 3 +++
 .github/workflows/check_docs.yml                 | 3 +++
 .github/workflows/check_examples.yml             | 3 +++
 .github/workflows/check_ni_datastore.yml         | 3 +++
 .github/workflows/check_utilities.yml            | 3 +++
 .github/workflows/publish.yml                    | 3 +++
 .github/workflows/run_unit_tests.yml             | 3 +++
 .github/workflows/sync_github_issues_to_azdo.yml | 5 +++++
 8 files changed, 26 insertions(+)

diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index 6c576fae..5a9be67d 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -1,5 +1,8 @@
 name: CI
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:
diff --git a/.github/workflows/check_docs.yml b/.github/workflows/check_docs.yml
index 22c6f900..298603d5 100644
--- a/.github/workflows/check_docs.yml
+++ b/.github/workflows/check_docs.yml
@@ -1,5 +1,8 @@
 name: Check docs
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
   workflow_dispatch:
diff --git a/.github/workflows/check_examples.yml b/.github/workflows/check_examples.yml
index bf14dd0a..c13dc3a3 100644
--- a/.github/workflows/check_examples.yml
+++ b/.github/workflows/check_examples.yml
@@ -1,5 +1,8 @@
 name: Check examples
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
   workflow_dispatch:
diff --git a/.github/workflows/check_ni_datastore.yml b/.github/workflows/check_ni_datastore.yml
index 004a7cb1..db967119 100644
--- a/.github/workflows/check_ni_datastore.yml
+++ b/.github/workflows/check_ni_datastore.yml
@@ -1,5 +1,8 @@
 name: Check analyzers
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
   workflow_dispatch:
diff --git a/.github/workflows/check_utilities.yml b/.github/workflows/check_utilities.yml
index 80a04d18..9e07bfe3 100644
--- a/.github/workflows/check_utilities.yml
+++ b/.github/workflows/check_utilities.yml
@@ -1,5 +1,8 @@
 name: Check utilities
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
   workflow_dispatch:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 81c4314e..c4692879 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,5 +1,8 @@
 name: Publish ni.datastore
 
+permissions:
+  contents: read
+
 on:
   release:
     types: [published]
diff --git a/.github/workflows/run_unit_tests.yml b/.github/workflows/run_unit_tests.yml
index 7a784bdb..d50ae682 100644
--- a/.github/workflows/run_unit_tests.yml
+++ b/.github/workflows/run_unit_tests.yml
@@ -1,5 +1,8 @@
 name: Run unit tests
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
     inputs:
diff --git a/.github/workflows/sync_github_issues_to_azdo.yml b/.github/workflows/sync_github_issues_to_azdo.yml
index 8c2f004d..36adb92b 100644
--- a/.github/workflows/sync_github_issues_to_azdo.yml
+++ b/.github/workflows/sync_github_issues_to_azdo.yml
@@ -1,5 +1,10 @@
 name: Sync issue to Azure DevOps work item
 
+# This workflow uses secrets.GH_REPO_TOKEN, which is not affected by the
+# permissions block. Since this workflow doesn't use the built-in
+# GITHUB_TOKEN, we can leave the permissions blank.
+permissions: {}
+
 on:
   issues:
     # Omit "labeled" and "unlabeled" to work around https://github.com/danhellem/github-actions-issue-to-work-item/issues/70

From a22ba6f612937b5d47d586b3a4db55137f61006e Mon Sep 17 00:00:00 2001
From: Michael Johansen <michael.johansen@emerson.com>
Date: Thu, 15 Oct 2026 11:15:23 -0500
Subject: [PATCH 2/3] Remove special permissions passed to CI from PR.

Signed-off-by: Michael Johansen <michael.johansen@emerson.com>
---
 .github/workflows/PR.yml | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/.github/workflows/PR.yml b/.github/workflows/PR.yml
index 2886cc3b..3d28ed8b 100644
--- a/.github/workflows/PR.yml
+++ b/.github/workflows/PR.yml
@@ -15,8 +15,4 @@ concurrency:
 jobs:
   run_ci:
     name: Run CI
-    uses: ./.github/workflows/CI.yml
-    permissions:
-      contents: read
-      checks: write
-      pull-requests: write
\ No newline at end of file
+    uses: ./.github/workflows/CI.yml
\ No newline at end of file

From b3288897630f2325fbe42ad6d020baddf0d1a80e Mon Sep 17 00:00:00 2001
From: Michael Johansen <michael.johansen@emerson.com>
Date: Thu, 15 Oct 2026 11:22:36 -0500
Subject: [PATCH 3/3] Add a workflow wide permissions block for PR.yml

Signed-off-by: Michael Johansen <michael.johansen@emerson.com>
---
 .github/workflows/PR.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/PR.yml b/.github/workflows/PR.yml
index 3d28ed8b..6e959818 100644
--- a/.github/workflows/PR.yml
+++ b/.github/workflows/PR.yml
@@ -1,5 +1,8 @@
 name: PR
 
+permissions:
+  contents: read
+
 on:
   pull_request:
     branches: