From 071db144285fc981a9ed4dcba914b894a78ff91e Mon Sep 17 00:00:00 2001
From: Matt McKay <mmcky@users.noreply.github.com>
Date: Wed, 5 Aug 2026 12:36:46 +1000
Subject: [PATCH] Add explicit permissions blocks so the default token can drop
 to read

Transcribes what the sibling repos already carry: ci and collab get
contents:read + pull-requests:write (the Netlify preview comment),
publish gets contents:write (peaceiris gh-pages push) + actions:read
(cache artifact download). linkcheck and cache write nothing with
GITHUB_TOKEN and need no block.

A job with a permissions block drops unlisted scopes to none, so this
is safe to merge before or after the repo-level flip -- and it is what
makes the flip safe. Part of QuantEcon/meta#347 item 4.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml      | 3 +++
 .github/workflows/collab.yml  | 3 +++
 .github/workflows/publish.yml | 3 +++
 3 files changed, 9 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b85d3bb..97bfcba 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -3,6 +3,9 @@ on: [pull_request]
 jobs:
   preview:
     runs-on: "runs-on=${{ github.run_id }}/family=g4dn.2xlarge/image=quantecon_ubuntu2404/disk=large"
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - uses: actions/checkout@v4
         with:
diff --git a/.github/workflows/collab.yml b/.github/workflows/collab.yml
index ae83d44..6a02db6 100644
--- a/.github/workflows/collab.yml
+++ b/.github/workflows/collab.yml
@@ -3,6 +3,9 @@ on: [pull_request]
 jobs:
   execution-checks:
     runs-on: "runs-on=${{ github.run_id }}/family=g4dn.2xlarge/image=ubuntu24-gpu-x64/disk=large"
+    permissions:
+      contents: read
+      pull-requests: write
     container:
       image: docker://us-docker.pkg.dev/colab-images/public/runtime
       options: --gpus all
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index a0b33ac..8de8f19 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -3,6 +3,9 @@ on:
   push:
     tags:
       - 'publish*'
+permissions:
+  contents: write   # peaceiris/actions-gh-pages pushes the built site to gh-pages
+  actions: read     # dawidd6/action-download-artifact reads the cache.yml build artifact
 jobs:
   publish:
     if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags')