From 644553a1fc9a8b0f6865191067d5a42ccfe4dbee Mon Sep 17 00:00:00 2001
From: LizardByte-bot <108553330+LizardByte-bot@users.noreply.github.com>
Date: Sat, 14 Feb 2026 14:22:23 +0000
Subject: [PATCH 1/2] chore: update global workflows

---
 .github/workflows/_codeql.yml      | 11 ++++++-----
 .github/workflows/_common-lint.yml |  5 +++--
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/_codeql.yml b/.github/workflows/_codeql.yml
index 15c5a6f60e73..5569a2ed7c0b 100644
--- a/.github/workflows/_codeql.yml
+++ b/.github/workflows/_codeql.yml
@@ -4,16 +4,13 @@
 # the above-mentioned repo.
 
 name: CodeQL
-permissions:
-  actions: read
-  contents: read
-  security-events: write
+permissions: {}
 
 on:
+  pull_request:
   push:
     branches:
       - master
-  pull_request:
   schedule:
     - cron: '00 12 * * 0'  # every Sunday at 12:00 UTC
 
@@ -26,3 +23,7 @@ jobs:
     name: CodeQL
     uses: LizardByte/.github/.github/workflows/__call-codeql.yml@master
     if: ${{ github.repository != 'LizardByte/.github' }}
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
diff --git a/.github/workflows/_common-lint.yml b/.github/workflows/_common-lint.yml
index 80be0ccfd254..e7760cbc06f1 100644
--- a/.github/workflows/_common-lint.yml
+++ b/.github/workflows/_common-lint.yml
@@ -4,8 +4,7 @@
 # the above-mentioned repo.
 
 name: common lint
-permissions:
-  contents: read
+permissions: {}
 
 on:
   pull_request:
@@ -19,3 +18,5 @@ jobs:
     name: Common Lint
     uses: LizardByte/.github/.github/workflows/__call-common-lint.yml@master
     if: ${{ github.repository != 'LizardByte/.github' }}
+    permissions:
+      contents: read

From 521d97c31dae2d0de15359c66a5d2564477acfd9 Mon Sep 17 00:00:00 2001
From: ReenigneArcher <42013603+ReenigneArcher@users.noreply.github.com>
Date: Sat, 14 Feb 2026 09:47:32 -0500
Subject: [PATCH 2/2] Pass GH_BOT_NAME as workflow input

Remove GH_BOT_NAME from the secrets block and add gh_bot_name under with to pass ${ { vars.GH_BOT_NAME } } as an input to the reusable workflow. This aligns the invocation with the reusable workflow's expected parameter name and fixes the parameter mismatch in .github/workflows/update-db.yml.
---
 .github/workflows/update-db.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/update-db.yml b/.github/workflows/update-db.yml
index aae9bc108f45..5987b33b548a 100644
--- a/.github/workflows/update-db.yml
+++ b/.github/workflows/update-db.yml
@@ -68,9 +68,9 @@ jobs:
     uses: LizardByte/LizardByte.github.io/.github/workflows/jekyll-build.yml@master
     secrets:
       GH_BOT_EMAIL: ${{ secrets.GH_BOT_EMAIL }}
-      GH_BOT_NAME: ${{ vars.GH_BOT_NAME }}
       GH_BOT_TOKEN: ${{ secrets.GH_BOT_TOKEN }}
     with:
+      gh_bot_name: ${{ vars.GH_BOT_NAME }}
       site_artifact: 'update'
       extract_archive: 'build.zip'
       target_branch: 'gh-pages'