From f9c9cedad355a86a7e65e62b0a2fee2c611868c1 Mon Sep 17 00:00:00 2001
From: Neil <4138956+nwparker@users.noreply.github.com>
Date: Wed, 21 Oct 2026 22:17:05 -0700
Subject: [PATCH] ci: declare read-only workflow token permissions (#31836)

---
 .github/workflows/computer-e2e.yml              | 3 +++
 .github/workflows/golden-e2e-experiment.yml     | 3 +++
 .github/workflows/linux-wayland-gpu-sandbox.yml | 3 +++
 .github/workflows/mobile-ios-release.yml        | 3 +++
 .github/workflows/mobile.yml                    | 3 +++
 .github/workflows/skill-update-roundtrip.yml    | 3 +++
 .github/workflows/terminal-perf.yml             | 3 +++
 7 files changed, 21 insertions(+)

diff --git a/.github/workflows/computer-e2e.yml b/.github/workflows/computer-e2e.yml
index 054c30be5e1..fb95dcfc682 100644
--- a/.github/workflows/computer-e2e.yml
+++ b/.github/workflows/computer-e2e.yml
@@ -68,6 +68,9 @@ concurrency:
   group: computer-e2e-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
+permissions:
+  contents: read
+
 jobs:
   native-smoke:
     if: github.event_name == 'pull_request' && github.event.pull_request.draft != true
diff --git a/.github/workflows/golden-e2e-experiment.yml b/.github/workflows/golden-e2e-experiment.yml
index 507c554e298..0db2f181e88 100644
--- a/.github/workflows/golden-e2e-experiment.yml
+++ b/.github/workflows/golden-e2e-experiment.yml
@@ -8,6 +8,9 @@ on:
         required: false
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   golden-e2e:
     name: golden e2e ${{ matrix.platform }} experiment
diff --git a/.github/workflows/linux-wayland-gpu-sandbox.yml b/.github/workflows/linux-wayland-gpu-sandbox.yml
index 9743afef452..5ce58c04b84 100644
--- a/.github/workflows/linux-wayland-gpu-sandbox.yml
+++ b/.github/workflows/linux-wayland-gpu-sandbox.yml
@@ -3,6 +3,9 @@ name: Linux Wayland GPU Sandbox
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   verify:
     name: wayland terminal input
diff --git a/.github/workflows/mobile-ios-release.yml b/.github/workflows/mobile-ios-release.yml
index 4c637183f0e..94de97d4954 100644
--- a/.github/workflows/mobile-ios-release.yml
+++ b/.github/workflows/mobile-ios-release.yml
@@ -23,6 +23,9 @@ on:
         required: false
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   ios-build:
     # GitHub-hosted macOS runner: required for Xcode. Expo SDK 55's
diff --git a/.github/workflows/mobile.yml b/.github/workflows/mobile.yml
index ca7e96eb0bb..226d848ec76 100644
--- a/.github/workflows/mobile.yml
+++ b/.github/workflows/mobile.yml
@@ -97,6 +97,9 @@ concurrency:
   group: mobile-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   verify:
     name: Mobile verify
diff --git a/.github/workflows/skill-update-roundtrip.yml b/.github/workflows/skill-update-roundtrip.yml
index f0d53b71d6e..9979384a5c9 100644
--- a/.github/workflows/skill-update-roundtrip.yml
+++ b/.github/workflows/skill-update-roundtrip.yml
@@ -27,6 +27,9 @@ concurrency:
   group: skill-roundtrip-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
+permissions:
+  contents: read
+
 jobs:
   roundtrip:
     if: github.event_name != 'pull_request' || github.event.pull_request.draft != true
diff --git a/.github/workflows/terminal-perf.yml b/.github/workflows/terminal-perf.yml
index a0e10e0eb90..dfc0f917d88 100644
--- a/.github/workflows/terminal-perf.yml
+++ b/.github/workflows/terminal-perf.yml
@@ -48,6 +48,9 @@ on:
     # terminal throughput regressions are caught before users report typing lag.
     - cron: '30 8 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   terminal-perf:
     name: terminal scale perf