From ae83f0f95f2e62e5576dbcf3b49a9f52cbc66ff6 Mon Sep 17 00:00:00 2001
From: Stacey Van Herk <13419300+svanherk@users.noreply.github.com>
Date: Tue, 13 Oct 2026 13:54:21 -0400
Subject: [PATCH] fix: GAUD-10684 - Backport workflow permissiosn to test
 publishing

---
 .github/workflows/ci.yml                  | 3 +++
 .github/workflows/release.yml             | 5 +++++
 .github/workflows/update-package-lock.yml | 4 ++++
 .github/workflows/vdiff.yml               | 7 +++++++
 4 files changed, 19 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1bfff105..e3dc7f63 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,6 +1,9 @@
 name: CI
 on: pull_request
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 198b9703..d5828fdb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,12 +5,17 @@ on:
       - main
       - '[0-9]+.x'
       - '[0-9]+.[0-9]+.x'
+
+permissions:
+  contents: read
+
 jobs:
   release:
     name: Release
     timeout-minutes: 5
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       id-token: write # for OIDC trusted publishing
     steps:
       - name: Checkout
diff --git a/.github/workflows/update-package-lock.yml b/.github/workflows/update-package-lock.yml
index 63f5e861..374a44ee 100644
--- a/.github/workflows/update-package-lock.yml
+++ b/.github/workflows/update-package-lock.yml
@@ -3,6 +3,10 @@ on:
   schedule:
     - cron: "30 12 * * 1-5" # Mon-Fri 8:30AM EDT. 7:30AM EST.
   workflow_dispatch: # manual trigger
+
+permissions:
+  pull-requests: write
+
 jobs:
   update:
     name: Update
diff --git a/.github/workflows/vdiff.yml b/.github/workflows/vdiff.yml
index 2c8c112c..35aa0460 100644
--- a/.github/workflows/vdiff.yml
+++ b/.github/workflows/vdiff.yml
@@ -1,5 +1,12 @@
 name: vdiff
 on: pull_request
+
+permissions:
+  actions: read
+  contents: write
+  pull-requests: write
+  statuses: write
+
 jobs:
   vdiff:
     timeout-minutes: 5