From 9dbdd08160ccfc5a822cfe85f6e5acdae051175f Mon Sep 17 00:00:00 2001
From: tintinhamans <5984296+tintinhamans@users.noreply.github.com>
Date: Sun, 13 Sep 2026 09:47:59 +0200
Subject: [PATCH] fix(ci): Make reusable workflow permissions caller-owned

---
 .github/workflows/build-historical.yml                 |  4 +++-
 .github/workflows/ci.yml                               | 10 ++++++----
 ...uild-toolchain.yml => reusable-build-toolchain.yml} |  5 ++++-
 .../{check-replays.yml => reusable-check-replays.yml}  |  6 +++---
 .github/workflows/weekly-release.yml                   |  4 ++--
 5 files changed, 18 insertions(+), 11 deletions(-)
 rename .github/workflows/{build-toolchain.yml => reusable-build-toolchain.yml} (97%)
 rename .github/workflows/{check-replays.yml => reusable-check-replays.yml} (98%)

diff --git a/.github/workflows/build-historical.yml b/.github/workflows/build-historical.yml
index 1d916e90783..45be3b62b48 100644
--- a/.github/workflows/build-historical.yml
+++ b/.github/workflows/build-historical.yml
@@ -1,7 +1,7 @@
 name: Build Historical
 
 permissions:
-  contents: write
+  contents: read
 
 on:
   workflow_dispatch:
@@ -215,6 +215,8 @@ jobs:
     needs: [prepare, build]
     if: ${{ github.event.inputs.create_release == 'true' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Download Generals Artifact
         if: ${{ github.event.inputs.game == 'Generals' || github.event.inputs.game == 'Both' }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5534a95ad29..b300a469c7f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -93,7 +93,7 @@ jobs:
             tools: true
             extras: true
       fail-fast: false
-    uses: ./.github/workflows/build-toolchain.yml
+    uses: ./.github/workflows/reusable-build-toolchain.yml
     with:
       game: "Generals"
       preset: ${{ matrix.preset }}
@@ -125,7 +125,7 @@ jobs:
             tools: true
             extras: true
       fail-fast: false
-    uses: ./.github/workflows/build-toolchain.yml
+    uses: ./.github/workflows/reusable-build-toolchain.yml
     with:
       game: "GeneralsMD"
       preset: ${{ matrix.preset }}
@@ -163,7 +163,7 @@ jobs:
             tools: true
             extras: true
       fail-fast: false
-    uses: ./.github/workflows/build-toolchain.yml
+    uses: ./.github/workflows/reusable-build-toolchain.yml
     with:
       game: "GeneralsMD"
       preset: ${{ matrix.preset }}
@@ -176,13 +176,15 @@ jobs:
     name: Replay Check GeneralsMD${{ matrix.preset && '' }}
     needs: build-generalsmd-vc6
     if: ${{ github.event_name == 'workflow_dispatch' || needs.detect-changes.outputs.generalsmd == 'true' || needs.detect-changes.outputs.shared == 'true' }}
+    permissions:
+      contents: read
     strategy:
       matrix:
         include:
           - preset: "vc6+t+e"
           - preset: "vc6-releaselog+t+e" # optimized build with logging and crashing enabled should be compatible, so we test that here.
       fail-fast: false
-    uses: ./.github/workflows/check-replays.yml
+    uses: ./.github/workflows/reusable-check-replays.yml
     with:
       game: "GeneralsMD"
       userdata: "GeneralsReplays/GeneralsZH/1.04"
diff --git a/.github/workflows/build-toolchain.yml b/.github/workflows/reusable-build-toolchain.yml
similarity index 97%
rename from .github/workflows/build-toolchain.yml
rename to .github/workflows/reusable-build-toolchain.yml
index 55441827fb7..e61e7f93624 100644
--- a/.github/workflows/build-toolchain.yml
+++ b/.github/workflows/reusable-build-toolchain.yml
@@ -1,6 +1,9 @@
 name: Build Toolchain
 
-# No permissions here - callers grant contents: read, and packages: write if using vcpkg.
+# WARNING: Do not declare permissions in this reusable workflow.
+# Declare the required permissions in each calling job:
+#   contents: read - required for all builds.
+#   packages: write - required for vcpkg binary-cache uploads only.
 
 on:
   workflow_call:
diff --git a/.github/workflows/check-replays.yml b/.github/workflows/reusable-check-replays.yml
similarity index 98%
rename from .github/workflows/check-replays.yml
rename to .github/workflows/reusable-check-replays.yml
index 5f27c600bef..4039246073f 100644
--- a/.github/workflows/check-replays.yml
+++ b/.github/workflows/reusable-check-replays.yml
@@ -1,8 +1,8 @@
 name: Check Replays
 
-permissions:
-  contents: read
-  pull-requests: write
+# WARNING: Do not declare permissions in this reusable workflow.
+# Declare the required permissions in each calling job:
+#   contents: read - required for replay checks.
 
 on:
   workflow_call:
diff --git a/.github/workflows/weekly-release.yml b/.github/workflows/weekly-release.yml
index 52f7bdb8be2..97b0ff34d92 100644
--- a/.github/workflows/weekly-release.yml
+++ b/.github/workflows/weekly-release.yml
@@ -97,7 +97,7 @@ jobs:
             extras: false
             release: true
       fail-fast: false
-    uses: ./.github/workflows/build-toolchain.yml
+    uses: ./.github/workflows/reusable-build-toolchain.yml
     with:
       game: "Generals"
       preset: ${{ matrix.preset }}
@@ -118,7 +118,7 @@ jobs:
             extras: false
             release: true
       fail-fast: false
-    uses: ./.github/workflows/build-toolchain.yml
+    uses: ./.github/workflows/reusable-build-toolchain.yml
     with:
       game: "GeneralsMD"
       preset: ${{ matrix.preset }}