From 3dfaa099efb9e59126f2aedee99baa196e2cde56 Mon Sep 17 00:00:00 2001
From: Eric Forte <119343520+eric-forte-elastic@users.noreply.github.com>
Date: Thu, 14 May 2026 16:04:20 -0400
Subject: [PATCH] [FR] Add explicit permissions blocks to workflows (#6145)

* Add permissions blocks to workflows

* Add cosmetic read blocks for consistency

  Co-authored-by: Arpit Jain <3242828+arpitjain099@users.noreply.github.com>

(cherry picked from commit 5a4d781939c0bb49a150d7b131a0ed0d5ea82485)
---
 .github/workflows/add-guidelines.yml         | 4 ++++
 .github/workflows/backport.yml               | 4 ++++
 .github/workflows/branch-status-checks.yml   | 3 +++
 .github/workflows/code-checks.yml            | 3 +++
 .github/workflows/community.yml              | 6 ++++++
 .github/workflows/esql-validation.yml        | 4 ++++
 .github/workflows/get-target-branches.yml    | 3 +++
 .github/workflows/kibana-mitre-update.yml    | 4 ++++
 .github/workflows/lock-versions.yml          | 4 ++++
 .github/workflows/manual-backport.yml        | 3 +++
 .github/workflows/pythonpackage.yml          | 3 +++
 .github/workflows/react-tests-dispatcher.yml | 3 +++
 .github/workflows/release-docs.yml           | 3 +++
 .github/workflows/release-fleet.yml          | 3 +++
 14 files changed, 50 insertions(+)

diff --git a/.github/workflows/add-guidelines.yml b/.github/workflows/add-guidelines.yml
index 1b972dd27..c44a57aeb 100644
--- a/.github/workflows/add-guidelines.yml
+++ b/.github/workflows/add-guidelines.yml
@@ -4,6 +4,10 @@ on:
   pull_request_target:
     types: [opened, labeled]
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   add-comment:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 08e0fdd27..b9c2fb883 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -11,6 +11,10 @@ on:
       - closed
       - ready_for_review
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   get-branches:
     uses: ./.github/workflows/get-target-branches.yml
diff --git a/.github/workflows/branch-status-checks.yml b/.github/workflows/branch-status-checks.yml
index 49c4b28a0..b6932fbe3 100644
--- a/.github/workflows/branch-status-checks.yml
+++ b/.github/workflows/branch-status-checks.yml
@@ -4,6 +4,9 @@ on:
   pull_request:
     branches: [ "*" ]
 
+permissions:
+  contents: read
+
 jobs:
   get-branches:
     uses: ./.github/workflows/get-target-branches.yml
diff --git a/.github/workflows/code-checks.yml b/.github/workflows/code-checks.yml
index 480939eba..916fc2171 100644
--- a/.github/workflows/code-checks.yml
+++ b/.github/workflows/code-checks.yml
@@ -11,6 +11,9 @@ on:
       - 'tests/**/*.py'
       - 'lib/**/*.py'
 
+permissions:
+  contents: read
+
 jobs:
   code-checks:
 
diff --git a/.github/workflows/community.yml b/.github/workflows/community.yml
index 93cd67e0b..42eb073c1 100644
--- a/.github/workflows/community.yml
+++ b/.github/workflows/community.yml
@@ -7,6 +7,12 @@ on:
   issues:
     types:
       - opened
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
 jobs:
   label:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/esql-validation.yml b/.github/workflows/esql-validation.yml
index cd8172182..b0d7802ed 100644
--- a/.github/workflows/esql-validation.yml
+++ b/.github/workflows/esql-validation.yml
@@ -2,6 +2,10 @@ name: ES|QL Validation
 on:
     pull_request:
       branches: [ "*" ]
+
+permissions:
+  contents: read
+
 jobs:
   build-and-validate:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/get-target-branches.yml b/.github/workflows/get-target-branches.yml
index 723b9040f..85b04c4e4 100644
--- a/.github/workflows/get-target-branches.yml
+++ b/.github/workflows/get-target-branches.yml
@@ -8,6 +8,9 @@ on:
         description: "List of target branches"
         value: ${{ jobs.list-target-branches.outputs.matrix }}
 
+permissions:
+  contents: read
+
 jobs:
   list-target-branches:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/kibana-mitre-update.yml b/.github/workflows/kibana-mitre-update.yml
index 761bc8d56..7090f0619 100644
--- a/.github/workflows/kibana-mitre-update.yml
+++ b/.github/workflows/kibana-mitre-update.yml
@@ -7,6 +7,10 @@ on:
     paths:
       - 'detection_rules/etc/attack-v*.json.gz'
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   create_issue:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lock-versions.yml b/.github/workflows/lock-versions.yml
index 59c8fd70f..9533a6ecf 100644
--- a/.github/workflows/lock-versions.yml
+++ b/.github/workflows/lock-versions.yml
@@ -8,6 +8,10 @@ on:
           # 7.17 was intentionally skipped because it was added late and was bug fix only
           default: '8.19,9.2,9.3,9.4'
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   pr:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/manual-backport.yml b/.github/workflows/manual-backport.yml
index 7c00bd8a2..ade86bfbc 100644
--- a/.github/workflows/manual-backport.yml
+++ b/.github/workflows/manual-backport.yml
@@ -12,6 +12,9 @@ on:
           description: 'Comma seperated list of files to skip staging e.g. detection_rules/etc/packages.yaml,detection_rules/attack.py)'
           required: false
 
+permissions:
+  contents: read
+
 jobs:
   commit:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/pythonpackage.yml b/.github/workflows/pythonpackage.yml
index 2bb979ad5..f4dbcee34 100644
--- a/.github/workflows/pythonpackage.yml
+++ b/.github/workflows/pythonpackage.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ "*" ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
diff --git a/.github/workflows/react-tests-dispatcher.yml b/.github/workflows/react-tests-dispatcher.yml
index 4418edc8a..dbf911d06 100644
--- a/.github/workflows/react-tests-dispatcher.yml
+++ b/.github/workflows/react-tests-dispatcher.yml
@@ -24,6 +24,9 @@ on:
       - '!rules/integrations/problemchild/*.toml'
       - '!rules/integrations/pad/*.toml'
 
+permissions:
+  contents: read
+
 jobs:
   dispatch:
     name: Run REACT tests
diff --git a/.github/workflows/release-docs.yml b/.github/workflows/release-docs.yml
index 39049e987..09b994ba8 100644
--- a/.github/workflows/release-docs.yml
+++ b/.github/workflows/release-docs.yml
@@ -17,6 +17,9 @@ on:
         description: 'Post version'
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   build-docs:
     name: Build Security Docs
diff --git a/.github/workflows/release-fleet.yml b/.github/workflows/release-fleet.yml
index 941ec0cbf..236fa6a07 100644
--- a/.github/workflows/release-fleet.yml
+++ b/.github/workflows/release-fleet.yml
@@ -33,6 +33,9 @@ on:
           - "true"
           - "false"
 
+permissions:
+  contents: write
+
 jobs:
     fleet-pr:
       name: Build package and create PR to integrations