From a1d89124c04c1c9d747dddd452e5f082cd284928 Mon Sep 17 00:00:00 2001
From: rohan436 <rohan.santhoshkumar@googlemail.com>
Date: Sat, 21 Feb 2026 18:23:56 +0800
Subject: [PATCH] ci: declare explicit token permissions in project workflows

---
 .github/workflows/add-to-project.yml    | 2 ++
 .github/workflows/latest-changes.yml    | 4 ++++
 .github/workflows/test-redistribute.yml | 3 +++
 3 files changed, 9 insertions(+)

diff --git a/.github/workflows/add-to-project.yml b/.github/workflows/add-to-project.yml
index dccea83f35..5db22cc15d 100644
--- a/.github/workflows/add-to-project.yml
+++ b/.github/workflows/add-to-project.yml
@@ -7,6 +7,8 @@ on:
       - opened
       - reopened
 
+permissions: {}
+
 jobs:
   add-to-project:
     name: Add to project
diff --git a/.github/workflows/latest-changes.yml b/.github/workflows/latest-changes.yml
index b9e45ea629..8e3b03c52e 100644
--- a/.github/workflows/latest-changes.yml
+++ b/.github/workflows/latest-changes.yml
@@ -16,6 +16,10 @@ on:
         required: false
         default: 'false'
 
+permissions:
+  contents: write
+  pull-requests: read
+
 jobs:
   latest-changes:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test-redistribute.yml b/.github/workflows/test-redistribute.yml
index ad9df4bf98..ff9f0560a1 100644
--- a/.github/workflows/test-redistribute.yml
+++ b/.github/workflows/test-redistribute.yml
@@ -9,6 +9,9 @@ on:
       - opened
       - synchronize
 
+permissions:
+  contents: read
+
 jobs:
   test-redistribute:
     runs-on: ubuntu-latest