From e28af0ffc3b50752d64e90eeaf690e611eb60e3a Mon Sep 17 00:00:00 2001
From: Eugene Yurtsev <eyurtsev@gmail.com>
Date: Wed, 2 Jul 2025 17:02:17 -0400
Subject: [PATCH] ci: set explicit workflow permissions to read (should be a
 no-op) (#5318)

* We're using restricted GITHUB_TOKENS by default.
* This is expected to be a no-op operation for codeql.
---
 .github/workflows/_integration_test.yml | 3 +++
 .github/workflows/_lint.yml             | 3 +++
 .github/workflows/_test.yml             | 3 +++
 .github/workflows/_test_langgraph.yml   | 3 +++
 .github/workflows/baseline.yml          | 3 +++
 .github/workflows/bench.yml             | 3 +++
 .github/workflows/ci.yml                | 3 +++
 .github/workflows/link_check.yml        | 3 +++
 .github/workflows/release.yml           | 3 +++
 .github/workflows/release_js.yml        | 3 +++
 .github/workflows/run_notebooks.yml     | 3 +++
 11 files changed, 33 insertions(+)

diff --git a/.github/workflows/_integration_test.yml b/.github/workflows/_integration_test.yml
index e6452c637..5857609ec 100644
--- a/.github/workflows/_integration_test.yml
+++ b/.github/workflows/_integration_test.yml
@@ -3,6 +3,9 @@ name: CLI integration test
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/_lint.yml b/.github/workflows/_lint.yml
index 585c232df..68c9a78f3 100644
--- a/.github/workflows/_lint.yml
+++ b/.github/workflows/_lint.yml
@@ -8,6 +8,9 @@ on:
         type: string
         description: "From which folder this pipeline executes"
 
+permissions:
+  contents: read
+
 env:
   # This env var allows us to get inline annotations when ruff has complaints.
   RUFF_OUTPUT_FORMAT: github
diff --git a/.github/workflows/_test.yml b/.github/workflows/_test.yml
index c572e96cb..6fb763003 100644
--- a/.github/workflows/_test.yml
+++ b/.github/workflows/_test.yml
@@ -8,6 +8,9 @@ on:
         type: string
         description: "From which folder this pipeline executes"
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/_test_langgraph.yml b/.github/workflows/_test_langgraph.yml
index 0a8b515ea..df09511e7 100644
--- a/.github/workflows/_test_langgraph.yml
+++ b/.github/workflows/_test_langgraph.yml
@@ -3,6 +3,9 @@ name: test
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/baseline.yml b/.github/workflows/baseline.yml
index a89bf8b3f..9b2c7cd71 100644
--- a/.github/workflows/baseline.yml
+++ b/.github/workflows/baseline.yml
@@ -7,6 +7,9 @@ on:
     paths:
       - "libs/**"
 
+permissions:
+  contents: read
+
 jobs:
   benchmark:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml
index e3eba31ac..f5484badb 100644
--- a/.github/workflows/bench.yml
+++ b/.github/workflows/bench.yml
@@ -5,6 +5,9 @@ on:
     paths:
       - "libs/**"
 
+permissions:
+  contents: read
+
 jobs:
   benchmark:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 43752eddf..9ee07bc32 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,9 @@ on:
     branches: [main]
   pull_request:
 
+permissions:
+  contents: read
+
 # If another push to the same PR or branch happens while this workflow is still running,
 # cancel the earlier run in favor of the next run.
 #
diff --git a/.github/workflows/link_check.yml b/.github/workflows/link_check.yml
index 05897c215..65e041e7b 100644
--- a/.github/workflows/link_check.yml
+++ b/.github/workflows/link_check.yml
@@ -11,6 +11,9 @@ on:
     - cron: "0 5 * * *"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   markdown-link-check:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e91f25804..78461653c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -8,6 +8,9 @@ on:
         type: string
         default: "libs/langgraph"
 
+permissions:
+  contents: read
+
 env:
   PYTHON_VERSION: "3.11"
 
diff --git a/.github/workflows/release_js.yml b/.github/workflows/release_js.yml
index 70617d6f1..bce535330 100644
--- a/.github/workflows/release_js.yml
+++ b/.github/workflows/release_js.yml
@@ -3,6 +3,9 @@ name: JS Release
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   publish:
     # Disallow publishing from branches that aren't `main`.
diff --git a/.github/workflows/run_notebooks.yml b/.github/workflows/run_notebooks.yml
index da49980cd..975df0191 100644
--- a/.github/workflows/run_notebooks.yml
+++ b/.github/workflows/run_notebooks.yml
@@ -11,6 +11,9 @@ on:
   schedule:
     - cron: "0 13 * * *"
 
+permissions:
+  contents: read
+
 defaults:
   run:
     working-directory: docs