From d7fd06ca8204452e886067e0ea43236dab1f67c5 Mon Sep 17 00:00:00 2001
From: Huang Xin <chrox.huang@gmail.com>
Date: Thu, 9 Apr 2026 13:33:25 +0800
Subject: [PATCH] chore: add explicit permissions to GitHub Actions workflows
 (#3807)

Fixes code scanning alerts #1, #2, #3, #4
(actions/missing-workflow-permissions).

- retry-workflow.yml rerun job: actions: write (to rerun workflows)
- upload-to-r2.yml upload-to-r2 job: contents: read (to download releases)
- upload-to-r2.yml retry-on-failure job: actions: write (to trigger retry)
- release.yml upload-to-r2 job: contents: read, actions: write

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/release.yml        | 3 +++
 .github/workflows/retry-workflow.yml | 2 ++
 .github/workflows/upload-to-r2.yml   | 4 ++++
 3 files changed, 9 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7b88c27b..dd633fed 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -391,6 +391,9 @@ jobs:
 
   upload-to-r2:
     needs: [get-release, build-tauri]
+    permissions:
+      contents: read
+      actions: write
     uses: ./.github/workflows/upload-to-r2.yml
     with:
       tag: ${{ needs.get-release.outputs.release_tag }}
diff --git a/.github/workflows/retry-workflow.yml b/.github/workflows/retry-workflow.yml
index 0219289b..7e0dd24c 100644
--- a/.github/workflows/retry-workflow.yml
+++ b/.github/workflows/retry-workflow.yml
@@ -8,6 +8,8 @@ on:
 jobs:
   rerun:
     runs-on: ubuntu-latest
+    permissions:
+      actions: write
     steps:
       - name: rerun ${{ inputs.run_id }}
         env:
diff --git a/.github/workflows/upload-to-r2.yml b/.github/workflows/upload-to-r2.yml
index 6b68c378..c462893d 100644
--- a/.github/workflows/upload-to-r2.yml
+++ b/.github/workflows/upload-to-r2.yml
@@ -17,6 +17,8 @@ on:
 jobs:
   upload-to-r2:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     timeout-minutes: 3
     strategy:
       fail-fast: false
@@ -70,6 +72,8 @@ jobs:
     if: failure() && fromJSON(github.run_attempt) < 3
     needs: [upload-to-r2]
     runs-on: ubuntu-latest
+    permissions:
+      actions: write
     steps:
       - env:
           GH_REPO: ${{ github.repository }}