From 2d8288fd0f7bffbf778f4118e03212d93db44f9d Mon Sep 17 00:00:00 2001
From: Eugene Yurtsev <eyurtsev@gmail.com>
Date: Fri, 25 Jul 2025 14:14:07 -0400
Subject: [PATCH 1/3] reduce permissions

---
 .github/workflows/release.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 78461653c..636f1cd06 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -137,7 +137,9 @@ jobs:
     needs:
       - build
       - release-notes
-    permissions: write-all
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/_test_release.yml
     with:
       working-directory: ${{ inputs.working-directory }}

From d24ad3d980f1feaf10cbb80f997753148485997c Mon Sep 17 00:00:00 2001
From: Eugene Yurtsev <eyurtsev@gmail.com>
Date: Fri, 25 Jul 2025 14:34:49 -0400
Subject: [PATCH 2/3] x

---
 .github/workflows/deploy_docs.yml | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/.github/workflows/deploy_docs.yml b/.github/workflows/deploy_docs.yml
index acd828488..4c31784c2 100644
--- a/.github/workflows/deploy_docs.yml
+++ b/.github/workflows/deploy_docs.yml
@@ -35,16 +35,7 @@ jobs:
         with:
           filter: "docs/docs/**"
 
-  # TODO: Uncomment this to run on PRs
-  # run-changed-notebooks:
-  #   needs: get-changed-files
-  #   uses: ./.github/workflows/run_notebooks.yml
-  #   secrets: inherit
-  #   with:
-  #     changed-files: ${{ needs.get-changed-files.outputs.changed-files }}
-
   deploy:
-    # needs: run-changed-notebooks
     runs-on: ubuntu-latest
     timeout-minutes: 10 # Job will be cancelled if it runs for more than 10 minutes
     env:

From 6710908d40d9811f48ae150c0d83b9e7e5df604e Mon Sep 17 00:00:00 2001
From: Eugene Yurtsev <eyurtsev@gmail.com>
Date: Fri, 25 Jul 2025 14:37:03 -0400
Subject: [PATCH 3/3] x

---
 .github/workflows/pr_lint.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/pr_lint.yml b/.github/workflows/pr_lint.yml
index 50749b528..f4bc62f51 100644
--- a/.github/workflows/pr_lint.yml
+++ b/.github/workflows/pr_lint.yml
@@ -39,6 +39,7 @@ jobs:
             scheduler-kafka
             sdk-py
             docs
+            ci
           requireScope: false
           ignoreLabels: |
             ignore-lint-pr-title