repo sync

.github/workflows/60-days-stale-check.yml

@@ -8,6 +8,10 @@ on:
   schedule:
     - cron: '40 16 * * *' # Run each day at 16:40 UTC / 8:40 PST
 
+permissions:
+  issues: write
+  pull-requests: write
+
 jobs:
   stale:
     if: github.repository == 'github/docs-internal' || github.repository == 'github/docs'

.github/workflows/add-review-template.yml

@@ -9,6 +9,9 @@ on:
     types:
       - labeled
 
+permissions:
+  contents: read
+
 jobs:
   comment-that-approved:
     name: Add review template

.github/workflows/auto-label-prs.yml

@@ -7,6 +7,10 @@ name: Auto label Pull Requests
 on:
   pull_request:
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   triage:
     if: github.repository == 'github/docs-internal'

.github/workflows/autoupdate-branch.yml

@@ -24,6 +24,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   autoupdate:
     if: github.repository == 'github/docs-internal' || github.repository == 'github/docs'

.github/workflows/browser-test.yml

@@ -22,6 +22,9 @@ on:
       # Ultimately, for debugging this workflow itself
       - .github/workflows/browser-test.yml
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/check-all-english-links.yml

@@ -9,6 +9,10 @@ on:
   schedule:
     - cron: '40 19 * * *' # once a day at 19:40 UTC / 11:40 PST
 
+permissions:
+  contents: read
+  issues: write
+
 jobs:
   check_all_english_links:
     name: Check all links

.github/workflows/check-broken-links-github-github.yml

@@ -9,6 +9,9 @@ on:
   schedule:
     - cron: '20 13 * * 1' # run every Monday at 1:20PM UTC
 
+permissions:
+  contents: read
+
 # **IMPORTANT:** Do not change the FREEZE environment variable set here!
 # This workflow runs on a recurring basis. To temporarily disable it (e.g.,
 # during a docs deployment freeze), add an Actions Secret to the repo settings

.github/workflows/check-for-spammy-issues.yml

@@ -7,6 +7,10 @@ name: Check for Spammy Issues
 on:
   issues:
     types: [opened]
+
+permissions:
+  contents: none
+
 jobs:
   spammy-title-check:
     name: Remove issues with spammy titles

.github/workflows/code-lint.yml

@@ -4,9 +4,6 @@ name: Lint code
 # **Why we have it**: We want some level of consistency to our code.
 # **Who does it impact**: Docs engineering, open-source engineering contributors.
 
-permissions:
-  contents: read
-
 on:
   workflow_dispatch:
   push:
@@ -26,6 +23,9 @@ on:
       # Ultimately, for debugging this workflow itself
       - .github/workflows/code-lint.yml
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest

.github/workflows/codeql.yml

@@ -15,6 +15,10 @@ on:
       - '**/*.js'
       - '.github/workflows/codeql.yml'
 
+permissions:
+  actions: read
+  contents: read
+
 jobs:
   build:
     if: github.repository == 'github/docs-internal' || github.repository == 'github/docs'

.github/workflows/confirm-internal-staff-work-in-docs.yml

@@ -13,6 +13,9 @@ on:
     types:
       - opened
 
+permissions:
+  contents: none
+
 jobs:
   check-team-membership:
     runs-on: ubuntu-latest

.github/workflows/content-changes-table-comment.yml

@@ -9,6 +9,10 @@ on:
   pull_request_target:
     types: [opened, synchronize, reopened]
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   PR-Preview-Links:
     if: github.event.pull_request.user.login != 'Octomerger'

.github/workflows/copy-api-issue-to-internal.yml

@@ -9,6 +9,9 @@ on:
     types:
       - labeled
 
+permissions:
+  contents: none
+
 jobs:
   transfer-issue:
     name: Transfer issue

.github/workflows/create-translation-batch-pr.yml

@@ -13,6 +13,9 @@ on:
   schedule:
     - cron: '25 */6 * * *' # Every six hours
 
+permissions:
+  contents: write
+
 jobs:
   create-translation-batch:
     name: Create translation batch

.github/workflows/crowdin-cleanup.yml

@@ -10,6 +10,9 @@ on:
     branches:
       - translations
 
+permissions:
+  contents: write
+
 jobs:
   homogenize_frontmatter:
     name: Homogenize frontmatter

.github/workflows/enterprise-dates.yml

@@ -11,6 +11,10 @@ on:
   schedule:
     - cron: '39 2 * * 2' # At 02:39 on Tuesday
 
+permissions:
+  contents: write
+  pull-requests: write
+
 # **IMPORTANT:** Do not change the FREEZE environment variable set here!
 # This workflow runs on a recurring basis. To temporarily disable it (e.g.,
 # during a docs deployment freeze), add an Actions Secret to the repo settings

.github/workflows/enterprise-release-sync-search-index.yml

@@ -26,6 +26,9 @@ on:
       - ready_for_review
       - unlocked
 
+permissions:
+  contents: write
+
 # This workflow requires a label in the format `sync-english-index-for-<PLAN@RELEASE>`
 jobs:
   updateIndices:
@@ -59,7 +62,6 @@ jobs:
         env:
           VERSION: ${{ steps.getVersion.outputs.versionToSync }}
           LANGUAGE: 'en'
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           npm run build
           npm run sync-search

.github/workflows/first-responder-docs-content.yml

@@ -13,6 +13,9 @@ on:
       - closed
       - unlabeled
 
+permissions:
+  contents: none
+
 jobs:
   first-responder-triage-pr:
     name: Triage PR to FR project board

.github/workflows/hubber-contribution-help.yml

@@ -12,12 +12,13 @@ on:
       - 'content/**'
       - 'data/**'
 
+permissions:
+  pull-requests: write
+
 jobs:
   check-team-membership:
     if: github.repository == 'github/docs-internal' && github.actor != 'github-openapi-bot'
     runs-on: ubuntu-latest
-    permissions:
-      pull-requests: write
     steps:
       - id: membership_check
         uses: actions/github-script@2b34a689ec86a68d8ab9478298f91d5401337b7d

.github/workflows/link-check-dotcom.yml

@@ -11,6 +11,9 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ${{ fromJSON('["ubuntu-latest", "self-hosted"]')[github.repository == 'github/docs-internal'] }}

.github/workflows/link-check-ghae.yml

@@ -11,6 +11,9 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ${{ fromJSON('["ubuntu-latest", "self-hosted"]')[github.repository == 'github/docs-internal'] }}

.github/workflows/link-check-ghec.yml

@@ -11,6 +11,9 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ${{ fromJSON('["ubuntu-latest", "self-hosted"]')[github.repository == 'github/docs-internal'] }}

.github/workflows/link-check-ghes.yml

@@ -11,6 +11,9 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ${{ fromJSON('["ubuntu-latest", "self-hosted"]')[github.repository == 'github/docs-internal'] }}

.github/workflows/merged-notification.yml

@@ -9,6 +9,9 @@ on:
     types:
       - 'closed'
 
+permissions:
+  issues: write
+
 jobs:
   comment:
     if: github.repository == 'github/docs' && github.event.pull_request.merged && github.event.pull_request.base.ref == github.event.repository.default_branch && github.event.pull_request.user.login != 'Octomerger'

.github/workflows/move-existing-issues-to-the-correct-repo.yml

@@ -7,6 +7,9 @@ name: Move existing issues to correct docs repo
 on:
   workflow_dispatch:
 
+permissions:
+  contents: none
+
 jobs:
   transfer_issues:
     runs-on: ubuntu-latest

.github/workflows/move-help-wanted-issues.yml

@@ -10,7 +10,7 @@ on:
       - labeled
 
 permissions:
-  issues: none
+  contents: none
 
 jobs:
   move_issues:

.github/workflows/move-new-issues-to-correct-docs-repo.yml

@@ -11,6 +11,9 @@ on:
       - transferred
       - reopened
 
+permissions:
+  contents: none
+
 jobs:
   transfer_issue:
     runs-on: ubuntu-latest

.github/workflows/move-ready-to-merge-pr.yaml

@@ -11,7 +11,6 @@ on:
 
 permissions:
   pull-requests: write
-  issues: write
 
 jobs:
   unmark_for_review:

.github/workflows/move-reopened-issues-to-triage.yaml

@@ -9,14 +9,16 @@ on:
     types:
       - reopened
 
+permissions:
+  repository-projects: write
+
 jobs:
   move-reopened-issue-to-triage:
     if: github.repository == 'github/docs'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/github-script@2b34a689ec86a68d8ab9478298f91d5401337b7d
         with:
-          github-token: ${{ github.token }}
           script: |
             const issueNumber = context.issue.number;
             const doneColumnId = 11167427;

.github/workflows/no-response.yaml

@@ -15,13 +15,16 @@ on:
     # Schedule for five minutes after the hour every hour
     - cron: '5 * * * *'
 
+permissions:
+  issues: write
+
 jobs:
   noResponse:
     runs-on: ubuntu-latest
     steps:
       - uses: lee-dohm/no-response@9bb0a4b5e6a45046f00353d5de7d90fb8bd773bb
         with:
-          token: ${{ github.token }}
+          token: ${{ secrets.GITHUB_TOKEN }}
           closeComment: >
             This issue has been automatically closed because there has been no response
             to our request for more information from the original author. With only the

.github/workflows/open-enterprise-issue.yml

@@ -9,6 +9,9 @@ on:
   schedule:
     - cron: '49 14 * * *' # At 14:49 UTC daily
 
+permissions:
+  contents: read
+
 jobs:
   open_enterprise_issue:
     name: Open Enterprise issue

.github/workflows/openapi-schema-check.yml

@@ -23,6 +23,9 @@ on:
       - 'script/rest/**/*.js'
       - 'package*.json'
 
+permissions:
+  contents: read
+
 jobs:
   check-schema-versions:
     if: ${{ github.repository == 'github/docs-internal' }}

.github/workflows/os-ready-for-review.yml

@@ -3,15 +3,15 @@ name: OS Ready for review
 # **What it does**: Adds pull requests and issues in the docs repository to the docs-content review board when the "waiting for review" label is added
 # **Why we have it**: So that contributors in the OS repo can easily get reviews from the docs-content team, and so that writers can see when a PR is ready for review
 # **Who does it impact**: Writers working in the docs repository
-permissions:
-  contents: read
-
 on:
   pull_request_target:
     types: [labeled]
   issues:
     types: [labeled]
 
+permissions:
+  contents: read
+
 jobs:
   request_doc_review:
     name: Request a review from the docs-content team

.github/workflows/pa11y.yml

@@ -8,6 +8,10 @@ on:
   workflow_dispatch:
   schedule:
     - cron: '25 17 * * *' # once a day at 17:25 UTC / 11:50 PST
+
+permissions:
+  contents: read
+
 jobs:
   test:
     if: github.repository == 'github/docs-internal' || github.repository == 'github/docs'