From bc78dd2ed40922f69f35e7e972cf993ee3ecb8eb Mon Sep 17 00:00:00 2001
From: "hf-security-analysis[bot]"
 <265538906+hf-security-analysis[bot]@users.noreply.github.com>
Date: Thu, 15 Oct 2026 15:20:16 +0000
Subject: [PATCH] fix(ci): scope job permissions in workflows flagged on #15046

---
 .github/workflows/issue_labeler.yml |  7 ++++---
 .github/workflows/pr_labeler.yml    | 15 ++++++++++++---
 2 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/issue_labeler.yml b/.github/workflows/issue_labeler.yml
index 683a819edd..2a199ce682 100644
--- a/.github/workflows/issue_labeler.yml
+++ b/.github/workflows/issue_labeler.yml
@@ -4,12 +4,13 @@ on:
   issues:
     types: [opened]
 
-permissions:
-  contents: read
-  issues: write
+permissions: {}
 
 jobs:
   label:
+    permissions:
+      contents: read
+      issues: write
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
diff --git a/.github/workflows/pr_labeler.yml b/.github/workflows/pr_labeler.yml
index 85b2d96d31..4e9cbbfcd8 100644
--- a/.github/workflows/pr_labeler.yml
+++ b/.github/workflows/pr_labeler.yml
@@ -4,12 +4,13 @@ on:
   pull_request_target:
     types: [opened, synchronize, reopened]
 
-permissions:
-  contents: read
-  pull-requests: write
+permissions: {}
 
 jobs:
   label:
+    permissions:
+      contents: read
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13  # v7.0.0
@@ -17,6 +18,9 @@ jobs:
           sync-labels: true
 
   missing-tests:
+    permissions:
+      contents: read
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
@@ -50,6 +54,9 @@ jobs:
           fi
 
   fixes-issue:
+    permissions:
+      issues: read
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - name: Check for linked closing issues
@@ -85,6 +92,8 @@ jobs:
           fi
 
   size-label:
+    permissions:
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - name: Label PR by diff size