From 0d53430cbc56dd1f33832255a1c04183da65ab44 Mon Sep 17 00:00:00 2001
From: e271828- <e271828-@users.noreply.github.com>
Date: Mon, 1 Dec 2025 09:53:05 -0500
Subject: [PATCH] =?UTF-8?q?chore:=20workflow=20cleanup=20=20=20-=20Set=20d?=
 =?UTF-8?q?efault=20GITHUB=5FTOKEN=20scope=20to=20contents:=20read=20in=20?=
 =?UTF-8?q?.github/workflows/=20=20=20=20=20tests.yaml=20and=20added=20job?=
 =?UTF-8?q?-level=20permissions=20to=20limit=20privileges:=20build=20=20?=
 =?UTF-8?q?=20=20=20now=20only=20has=20contents=20+=20actions:=20write=20f?=
 =?UTF-8?q?or=20cache=20save,=20performance=20only=20=20=20=20=20contents/?=
 =?UTF-8?q?actions:=20read/issues:=20write=20for=20PR=20comments,=20test?=
 =?UTF-8?q?=20only=20contents:=20=20=20=20=20read,=20create-an-issue=20onl?=
 =?UTF-8?q?y=20contents/issues:=20write,=20release=20only=20contents:=20?=
 =?UTF-8?q?=20=20=20=20read.=20=20=20-=20Corrected=20the=20scheduled=20iss?=
 =?UTF-8?q?ue-creation=20guard=20to=20github.event=5Fname=20=3D=3D=20=20?=
 =?UTF-8?q?=20=20=20'schedule'=20so=20it=20can=E2=80=99t=20accidentally=20?=
 =?UTF-8?q?run=20outside=20the=20intended=20trigger.=20=20=20-=20Actions?=
 =?UTF-8?q?=20remain=20commit-pinned;=20no=20unpinned=20third-party=20acti?=
 =?UTF-8?q?ons=20found.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/tests.yaml | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 2bdbb41..90a3793 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -9,8 +9,14 @@ on:
   schedule:
     - cron: '0 0 * * 0' # https://crontab.guru/every-week
 
+permissions:
+  contents: read
+
 jobs:
   build:
+    permissions:
+      contents: read
+      actions: write
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -26,6 +32,10 @@ jobs:
         key: reassure-baseline-${{ github.sha }}
 
   performance:
+    permissions:
+      contents: read
+      actions: read
+      issues: write
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
     steps:
@@ -57,6 +67,8 @@ jobs:
 
   test:
     needs: build
+    permissions:
+      contents: read
     runs-on: ${{ matrix.os }}
     outputs:
       rn-version: ${{ steps.rn-version.outputs.value }}
@@ -107,9 +119,12 @@ jobs:
       working-directory: react-native-hcaptcha-example
 
   create-an-issue:
+    permissions:
+      contents: read
+      issues: write
     runs-on: ubuntu-latest
     needs: test
-    if: always() && github.event == 'schedule' && needs.test.result == 'failure'
+    if: always() && github.event_name == 'schedule' && needs.test.result == 'failure'
     steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
     - run: |
@@ -126,6 +141,8 @@ jobs:
         filename: .github/examples-issue-template.md
 
   release:
+    permissions:
+      contents: read
     if: github.event_name == 'release'
     needs: test
     runs-on: ubuntu-latest