From 80266c54272f57f4a8ff39408f88fc4d5087e95d Mon Sep 17 00:00:00 2001
From: Aaron Bull Schaefer <aaron@elasticdog.com>
Date: Thu, 21 May 2026 15:34:45 -0700
Subject: [PATCH] Limit GitHub App token permissions in workflows

Request contents: write for all create-github-app-token call sites
because the generated token is used for checkout and for writing
repository refs.

Also request pull-requests: write in the version bump workflows because
the same token is passed to peter-evans/create-pull-request to open
release PRs.

The tag workflows only create or push Git tags, so contents: write is
enough there.
---
 .github/workflows/bump-version-flutter-app.yml   | 2 ++
 .github/workflows/bump-version-flutter-lib.yml   | 2 ++
 .github/workflows/bump-version-rust.yml          | 2 ++
 .github/workflows/tag-if-missing.yml             | 1 +
 .github/workflows/tag-untagged-releases-rust.yml | 1 +
 5 files changed, 8 insertions(+)

diff --git a/.github/workflows/bump-version-flutter-app.yml b/.github/workflows/bump-version-flutter-app.yml
index 89257ee..8eebff2 100644
--- a/.github/workflows/bump-version-flutter-app.yml
+++ b/.github/workflows/bump-version-flutter-app.yml
@@ -34,6 +34,8 @@ jobs:
         with:
           client-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
 
       - name: Checkout source code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
diff --git a/.github/workflows/bump-version-flutter-lib.yml b/.github/workflows/bump-version-flutter-lib.yml
index 8877b0d..4480150 100644
--- a/.github/workflows/bump-version-flutter-lib.yml
+++ b/.github/workflows/bump-version-flutter-lib.yml
@@ -38,6 +38,8 @@ jobs:
         with:
           client-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
 
       - name: Checkout source code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
diff --git a/.github/workflows/bump-version-rust.yml b/.github/workflows/bump-version-rust.yml
index a5ff7c3..2c0ce99 100644
--- a/.github/workflows/bump-version-rust.yml
+++ b/.github/workflows/bump-version-rust.yml
@@ -49,6 +49,8 @@ jobs:
         with:
           client-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
 
       - name: Checkout source code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
diff --git a/.github/workflows/tag-if-missing.yml b/.github/workflows/tag-if-missing.yml
index be0994e..92b14a9 100644
--- a/.github/workflows/tag-if-missing.yml
+++ b/.github/workflows/tag-if-missing.yml
@@ -26,6 +26,7 @@ jobs:
         with:
           client-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write
 
       - name: Checkout source code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
diff --git a/.github/workflows/tag-untagged-releases-rust.yml b/.github/workflows/tag-untagged-releases-rust.yml
index 78e92e8..c40581c 100644
--- a/.github/workflows/tag-untagged-releases-rust.yml
+++ b/.github/workflows/tag-untagged-releases-rust.yml
@@ -27,6 +27,7 @@ jobs:
         with:
           client-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write
 
       - name: Checkout source code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd