From 0c5f62fa0fbf529d73a9e5ea2813734a41ac136a Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 30 Jul 2026 15:39:00 +0000
Subject: [PATCH 1/2] Initial plan


From 82362d756bee5d543a00a24fc65fb4df4ec550a9 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 30 Jul 2026 15:48:42 +0000
Subject: [PATCH 2/2] Fix token permissions: move security-events write to
 job-level (alert #571)

---
 .github/workflows/cicd.yml           | 5 ++++-
 .github/workflows/codeql.yml         | 4 +++-
 .github/workflows/reusable-build.yml | 1 +
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/cicd.yml b/.github/workflows/cicd.yml
index 052e6b7f94..89d12021d8 100644
--- a/.github/workflows/cicd.yml
+++ b/.github/workflows/cicd.yml
@@ -36,7 +36,6 @@ permissions:
   id-token: write  # Required to log in to Azure.
   contents: read
   checks: read  # Required by reusable-test.yml to check build status.
-  security-events: write  # Required by codeql task.
   issues: write  # Required to create issues.
 
 jobs:
@@ -337,6 +336,10 @@ jobs:
     # Always run this job.
     needs: regular
     if: github.event_name == 'schedule' || github.event_name == 'pull_request' || github.event_name == 'push' || github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch'
+    permissions:
+      checks: read
+      contents: read
+      security-events: write
     uses: ./.github/workflows/ossar-scan.yml
     with:
       build_artifact: Build-x64
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index af199e78f9..ae2ce88349 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -24,7 +24,6 @@ permissions:
   id-token: write  # Required to log in to Azure.
   contents: read
   checks: read  # Required by reusable-test.yml to check build status.
-  security-events: write  # Required by codeql task.
   issues: write  # Required to create issues.
 
 jobs:
@@ -33,6 +32,9 @@ jobs:
   codeql:
     # Only run during daily scheduled run
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    permissions:
+      contents: read
+      security-events: write  # Required by codeql task.
     uses: ./.github/workflows/reusable-build.yml
     with:
       ref: ${{ github.ref }}
diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml
index 1768f4fcfc..eb33b874b2 100644
--- a/.github/workflows/reusable-build.yml
+++ b/.github/workflows/reusable-build.yml
@@ -71,6 +71,7 @@ on:
 
 permissions:
   contents: read
+  security-events: write  # Required by codeql-action/analyze when build_codeql is true.
 
 jobs:
   build: