From 9b6431fae1d9c09217df7b0e82f83177278f573e Mon Sep 17 00:00:00 2001
From: DevAsadYasin <dev.asad.yasin@gmail.com>
Date: Wed, 21 Oct 2026 18:50:45 -0400
Subject: [PATCH 1/2] ci: restrict GITHUB_TOKEN permissions in workflows

Declare a read-only top-level permissions block on every workflow so a
compromised step cannot inherit the repository's default write scopes.
Keep existing job-level write grants (codecov OIDC, release failure issues).

Fixes #1333

Signed-off-by: DevAsadYasin <dev.asad.yasin@gmail.com>
---
 .github/workflows/backport.yaml         | 2 ++
 .github/workflows/build-tag.yaml        | 3 +++
 .github/workflows/build.yaml            | 3 +++
 .github/workflows/dapr-bot-schedule.yml | 2 ++
 .github/workflows/dapr-bot.yml          | 2 ++
 .github/workflows/fossa.yaml            | 4 ++++
 .github/workflows/release-tag.yaml      | 3 +++
 .github/workflows/run-tests.yaml        | 4 ++++
 8 files changed, 23 insertions(+)

diff --git a/.github/workflows/backport.yaml b/.github/workflows/backport.yaml
index 82180548c..155c9eda1 100644
--- a/.github/workflows/backport.yaml
+++ b/.github/workflows/backport.yaml
@@ -19,6 +19,8 @@ on:
       - closed
       - labeled
 
+permissions: {}
+
 jobs:
   backport:
     uses: dapr/.github/.github/workflows/backport.yaml@main
diff --git a/.github/workflows/build-tag.yaml b/.github/workflows/build-tag.yaml
index a1515e56f..095b7b511 100644
--- a/.github/workflows/build-tag.yaml
+++ b/.github/workflows/build-tag.yaml
@@ -6,6 +6,9 @@ on:
       - v*
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index f9d5b6a80..ffa81aa51 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -13,6 +13,9 @@ on:
   workflow_dispatch:
   merge_group:
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/dapr-bot-schedule.yml b/.github/workflows/dapr-bot-schedule.yml
index 562a5fa20..595a611a2 100644
--- a/.github/workflows/dapr-bot-schedule.yml
+++ b/.github/workflows/dapr-bot-schedule.yml
@@ -18,6 +18,8 @@ on:
     - cron: '*/10 * * * *'
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   automerge:
     uses: dapr/.github/.github/workflows/automerge.yaml@main
diff --git a/.github/workflows/dapr-bot.yml b/.github/workflows/dapr-bot.yml
index 7c3cb2117..aa9f5b27f 100644
--- a/.github/workflows/dapr-bot.yml
+++ b/.github/workflows/dapr-bot.yml
@@ -3,6 +3,8 @@ name: dapr-bot
 on:
   issue_comment: {types: created}
 
+permissions: {}
+
 jobs:
   daprbot:
     name: bot-processor
diff --git a/.github/workflows/fossa.yaml b/.github/workflows/fossa.yaml
index 0a6378e3d..8b486960f 100644
--- a/.github/workflows/fossa.yaml
+++ b/.github/workflows/fossa.yaml
@@ -28,6 +28,10 @@ on:
       - release-*
       - feature/*
   workflow_dispatch: {}
+
+permissions:
+  contents: read
+
 jobs:
   fossa-scan:
     if: github.repository_owner == 'dapr' # FOSSA is not intended to run on forks.
diff --git a/.github/workflows/release-tag.yaml b/.github/workflows/release-tag.yaml
index a5c06d7bd..1de924577 100644
--- a/.github/workflows/release-tag.yaml
+++ b/.github/workflows/release-tag.yaml
@@ -29,6 +29,9 @@ concurrency:
   group: release-tag-${{ github.ref }}
   cancel-in-progress: false
 
+permissions:
+  contents: read
+
 jobs:
   tag:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/run-tests.yaml b/.github/workflows/run-tests.yaml
index 5861fdb9e..16b4f4b1a 100644
--- a/.github/workflows/run-tests.yaml
+++ b/.github/workflows/run-tests.yaml
@@ -25,6 +25,10 @@ on:
   repository_dispatch:
     types: [validate-examples]
   merge_group:
+
+permissions:
+  contents: read
+
 jobs:
   validate:
     runs-on: ubuntu-latest

From 5d97de97d791debe1a9ff83bb5e46825700f1786 Mon Sep 17 00:00:00 2001
From: Asad Yasin <dev.asad.yasin@gmail.com>
Date: Fri, 23 Oct 2026 14:47:02 -0400
Subject: [PATCH 2/2] ci: drop redundant job permissions in release-tag (#1334)

Signed-off-by: Asad Yasin <dev.asad.yasin@gmail.com>
---
 .github/workflows/release-tag.yaml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/workflows/release-tag.yaml b/.github/workflows/release-tag.yaml
index 1de924577..ff2ca90e9 100644
--- a/.github/workflows/release-tag.yaml
+++ b/.github/workflows/release-tag.yaml
@@ -35,8 +35,6 @@ permissions:
 jobs:
   tag:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     steps:
     - uses: actions/checkout@v7
       with: