.github: scope actions: write to merge-queue self-cancel jobs (#21132)

.github/workflows/check-large-files.yml

@@ -8,6 +8,10 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+  actions: write
+
 jobs:
   check:
     runs-on: ubuntu-24.04

.github/workflows/lint.yml

@@ -7,6 +7,10 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+  actions: write
+
 jobs:
   lint:
     runs-on: ubuntu-latest

.github/workflows/reproducible-build.yml

@@ -8,6 +8,10 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+  actions: write
+
 jobs:
   reproducible-build:
     strategy:

.github/workflows/sonar.yml

@@ -17,6 +17,11 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+  actions: write
+  pull-requests: read
+
 jobs:
   sonar:
     runs-on: ubuntu-24.04

.github/workflows/test-all-erigon-race.yml

@@ -8,12 +8,18 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 jobs:
   # Workflow files can't read local files directly — they must be loaded via a
   # job step. We do this so the matrix group names come from the same source as
   # the test code (tools/test-groups), keeping CI and local runs in sync.
   load-matrix:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: write
     timeout-minutes: 60
     outputs:
       test-groups: ${{ steps.load.outputs.groups }}
@@ -57,6 +63,9 @@ jobs:
           - parallel
     name: tests-linux (${{ matrix.os }}, ${{ matrix.test-group }}, ${{ matrix.exec_mode }})
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+      actions: write
 
     steps:
       - name: Declare runners

.github/workflows/test-all-erigon.yml

@@ -8,6 +8,10 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+  actions: write
+
 jobs:
   tests-mac-linux:
     strategy:

.github/workflows/test-bench.yml

@@ -20,6 +20,10 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+  actions: write
+
 jobs:
   benchmarks:
     name: benchmarks (${{ matrix.exec_mode }})

.github/workflows/test-eest-spec.yml

@@ -13,6 +13,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 jobs:
   # Matrix entries (shard / workers / max-allowed-failures) come from
   # tools/eest-spec-shards.yml so this workflow and tools/run-eest-spec-test.sh
@@ -53,6 +56,9 @@ jobs:
       matrix:
         include: ${{ fromJson(needs.load-matrix.outputs.matrix) }}
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      actions: write
     timeout-minutes: 60
     env:
       RAMDISK_SIZE_MB: '8192'
@@ -139,6 +145,9 @@ jobs:
     if: ${{ !inputs.cache-warming-only }}
     name: eest-shard-coverage
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      actions: write
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v7

.github/workflows/test-integration-caplin.yml

@@ -7,13 +7,19 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     strategy:
       matrix:
         #        disable macos-15 until https://github.com/erigontech/erigon/issues/8789
         os: [ ubuntu-24.04 ] # required check includes runner version. Do not change it only here.
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+      actions: write
     timeout-minutes: 60
 
     steps:
@@ -66,6 +72,9 @@ jobs:
       matrix:
         os: [ windows-2025 ]
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+      actions: write
     timeout-minutes: 60
 
     steps: