From 8088ea50c24318b4e789c7626de2444ea9d8cb70 Mon Sep 17 00:00:00 2001
From: Lauren Tan <poteto@users.noreply.github.com>
Date: Fri, 21 Mar 2025 15:48:09 -0400
Subject: [PATCH] [ci] Add missing permissions

Missed these ones earlier.
---
 .github/workflows/compiler_discord_notify.yml             | 3 +++
 .github/workflows/runtime_discord_notify.yml              | 3 +++
 .github/workflows/shared_close_direct_sync_branch_prs.yml | 3 +++
 .github/workflows/shared_label_core_team_prs.yml          | 5 +++++
 4 files changed, 14 insertions(+)

diff --git a/.github/workflows/compiler_discord_notify.yml b/.github/workflows/compiler_discord_notify.yml
index ca7feaae50..372d60a7e7 100644
--- a/.github/workflows/compiler_discord_notify.yml
+++ b/.github/workflows/compiler_discord_notify.yml
@@ -19,6 +19,9 @@ jobs:
     if: ${{ needs.check_maintainer.outputs.is_core_team == 'true' }}
     needs: check_maintainer
     runs-on: ubuntu-latest
+    permissions:
+      # Used by check_maintainer
+      contents: read
     steps:
       - name: Discord Webhook Action
         uses: tsickert/discord-webhook@86dc739f3f165f16dadc5666051c367efa1692f4
diff --git a/.github/workflows/runtime_discord_notify.yml b/.github/workflows/runtime_discord_notify.yml
index c6da99646c..8c75a8e685 100644
--- a/.github/workflows/runtime_discord_notify.yml
+++ b/.github/workflows/runtime_discord_notify.yml
@@ -19,6 +19,9 @@ jobs:
     if: ${{ needs.check_maintainer.outputs.is_core_team == 'true' }}
     needs: check_maintainer
     runs-on: ubuntu-latest
+    permissions:
+      # Used by check_maintainer
+      contents: read
     steps:
       - name: Discord Webhook Action
         uses: tsickert/discord-webhook@86dc739f3f165f16dadc5666051c367efa1692f4
diff --git a/.github/workflows/shared_close_direct_sync_branch_prs.yml b/.github/workflows/shared_close_direct_sync_branch_prs.yml
index abf8db919f..01db090740 100644
--- a/.github/workflows/shared_close_direct_sync_branch_prs.yml
+++ b/.github/workflows/shared_close_direct_sync_branch_prs.yml
@@ -15,6 +15,9 @@ env:
 jobs:
   close_pr:
     runs-on: ubuntu-latest
+    permissions:
+      # Used to create a review and close PRs
+      pull-requests: write
     steps:
       - name: Close PR
         uses: actions/github-script@v7
diff --git a/.github/workflows/shared_label_core_team_prs.yml b/.github/workflows/shared_label_core_team_prs.yml
index 9b9e6149ed..e3acc5827b 100644
--- a/.github/workflows/shared_label_core_team_prs.yml
+++ b/.github/workflows/shared_label_core_team_prs.yml
@@ -20,6 +20,11 @@ jobs:
     if: ${{ needs.check_maintainer.outputs.is_core_team == 'true' }}
     runs-on: ubuntu-latest
     needs: check_maintainer
+    permissions:
+      # Used by check_maintainer
+      contents: read
+      # Used to add labels
+      issues: write
     steps:
       - name: Label PR as React Core Team
         uses: actions/github-script@v7