From ce6bd6ef352b8ee8386f322439ae8a6c656601a8 Mon Sep 17 00:00:00 2001
From: ashwin1111 <winash1998@gmail.com>
Date: Mon, 27 Jul 2026 11:22:07 +0530
Subject: [PATCH] Add explicit workflow permissions

---
 .github/workflows/jscpd-duplication-check.yml | 5 ++++-
 .github/workflows/original-test.yml           | 4 ++++
 .github/workflows/secrets-scan.yml            | 6 +++++-
 .github/workflows/test-myself.yml             | 4 ++++
 4 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/jscpd-duplication-check.yml b/.github/workflows/jscpd-duplication-check.yml
index 7e81f47..e94945c 100644
--- a/.github/workflows/jscpd-duplication-check.yml
+++ b/.github/workflows/jscpd-duplication-check.yml
@@ -9,6 +9,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   call-jscpd-duplication-check:
     if: ${{ github.event.pull_request.draft == false }}
@@ -23,4 +27,3 @@ jobs:
       # The shared workflow reads jscpd v4's per-format `total` schema.
       command_to_run: 'pnpm dlx jscpd@4.0.8 --ignore "**/node_modules/**" --output report --reporters json'
       package_manager: 'pnpm'
-
diff --git a/.github/workflows/original-test.yml b/.github/workflows/original-test.yml
index e553671..e4a2f6a 100644
--- a/.github/workflows/original-test.yml
+++ b/.github/workflows/original-test.yml
@@ -4,6 +4,10 @@ on:
   pull_request:
     types: [assigned,  opened,  synchronize,  reopened]
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   lint-and-test:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/secrets-scan.yml b/.github/workflows/secrets-scan.yml
index 5310da2..bebdb08 100644
--- a/.github/workflows/secrets-scan.yml
+++ b/.github/workflows/secrets-scan.yml
@@ -9,6 +9,10 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   secrets-scan:
     runs-on: ubuntu-latest
@@ -23,4 +27,4 @@ jobs:
           GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE_KEY }}
           GITLEAKS_NOTIFY_USER_LIST: ${{ vars.GITLEAKS_NOTIFY_USER_LIST }}
           GITLEAKS_ENABLE_COMMENTS: 'true'
-          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: 'false'
\ No newline at end of file
+          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: 'false'
diff --git a/.github/workflows/test-myself.yml b/.github/workflows/test-myself.yml
index e708eb6..a5cdfb3 100644
--- a/.github/workflows/test-myself.yml
+++ b/.github/workflows/test-myself.yml
@@ -4,6 +4,10 @@ on:
   pull_request:
     types: [assigned,  opened,  synchronize,  reopened]
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   lint-and-test:
     runs-on: ubuntu-latest