From 67dac8ddad506c8b20f0261b3cdf09d2de882d67 Mon Sep 17 00:00:00 2001
From: Romain Manni-Bucau <rmannibucau@gmail.com>
Date: Wed, 29 Jul 2026 10:19:49 +0200
Subject: [PATCH] [ci][gh][workflow] explicit action hash and permissions

---
 .github/workflows/pr-automation.yml   | 8 +++++++-
 .github/workflows/release-drafter.yml | 9 +++++++--
 .github/workflows/stale.yml           | 7 ++++++-
 3 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/pr-automation.yml b/.github/workflows/pr-automation.yml
index de4e3e006ea9..e11ad3369ddc 100644
--- a/.github/workflows/pr-automation.yml
+++ b/.github/workflows/pr-automation.yml
@@ -19,9 +19,15 @@ name: PR Automation
 on:
   pull_request_target:
     types:
+      # zizmor: ignore[dangerous-triggers]
       - closed
 
+permissions: {}
+
 jobs:
   pr-automation:
     name: PR Automation
-    uses: apache/maven-gh-actions-shared/.github/workflows/pr-automation.yml@v5
+    permissions:
+      issues: write
+      pull-requests: write
+    uses: apache/maven-gh-actions-shared/.github/workflows/pr-automation.yml@8599b638c78a2bec146a98d75d4c8b4e8458324f # v5
diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml
index 492f0b590337..3db2fd85da07 100644
--- a/.github/workflows/release-drafter.yml
+++ b/.github/workflows/release-drafter.yml
@@ -22,6 +22,11 @@ on:
       - master
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
-   update_release_draft:
-      uses: apache/maven-gh-actions-shared/.github/workflows/release-drafter.yml@v5
+  update_release_draft:
+    permissions:
+      contents: write
+      issues: write
+    uses: apache/maven-gh-actions-shared/.github/workflows/release-drafter.yml@8599b638c78a2bec146a98d75d4c8b4e8458324f # v5
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 39ebedf35a75..97f18b62ba09 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -23,6 +23,11 @@ on:
   issue_comment:
     types: [ 'created' ]
 
+permissions: {}
+
 jobs:
   stale:
-    uses: 'apache/maven-gh-actions-shared/.github/workflows/stale.yml@v5'
+    permissions:
+      issues: write
+      pull-requests: write
+    uses: apache/maven-gh-actions-shared/.github/workflows/stale.yml@8599b638c78a2bec146a98d75d4c8b4e8458324f # v5