Repository: smithy-lang/smithy-rs
Pull request #4084: Scope `GITHUB_TOKEN` permissions
Author: login: landonxjames
Created: 2025-04-03T21:51:46Z | Merged: 2025-04-08T17:40:19Z

## Description
This PR does a few things related to scoping our tokens:
* Add a `- uses: GitHubSecurityLab/actions-permissions/monitor@v1` to most of our actions so we can get ongoing summaries of the permissions each action is using. Some actions, like Windows tests and the TLS tests, are excluded because they are not supported or the proxy it uses breaks the test.
* Add explicit `permissions` scoping to various jobs that need it.
* Although not part of the PR I have changed our Workflow Permissions (in Settings > Actions > General > Workflow Permissions) from defaulting to Read/Write to Read Only.


## Testing
<!--- Please describe in detail how you tested your changes -->
<!--- Include details of your testing environment, and the tests you ran to -->
<!--- see how your change affects other areas of the code, etc. -->
* The CI for this PR ran successfully (except the Canary, but that appears to be an issue unrelated to this PR)
* A dry-run release using the workflows from this branch succeeded https://github.com/smithy-lang/smithy-rs/actions/runs/14275005243
* Various other manually runnable actions tested against this branch:
  * Daily credentials verification: https://github.com/smithy-lang/smithy-rs/actions/runs/14288824835
  * Update lockfiles: https://github.com/smithy-lang/smithy-rs/actions/runs/14288809742
  * Invoke canary (failed but not for permissions reasons): https://github.com/smithy-lang/smithy-rs/actions/runs/14288631692

**Note:** I did not test the prod release workflow for obvious reasons. It might need permissions added next time it is invoked. I will cut a release as a follow up to this PR to see if anything needs updating

## Checklist

----

_By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice._



Diff:
diff --git a/.github/workflows/backport-pull-request.yml b/.github/workflows/backport-pull-request.yml
index a3e265f30dd..ed2de7ab0fb 100644
--- a/.github/workflows/backport-pull-request.yml
+++ b/.github/workflows/backport-pull-request.yml
@@ -19,6 +19,7 @@ jobs:
   create-backport-pull-request:
     runs-on: ubuntu-latest
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - name: Checkout
       uses: actions/checkout@v4
       with:
diff --git a/.github/workflows/ci-main.yml b/.github/workflows/ci-main.yml
index 82bee3806d8..4750859b82d 100644
--- a/.github/workflows/ci-main.yml
+++ b/.github/workflows/ci-main.yml
@@ -18,6 +18,12 @@ concurrency:
 env:
   ecr_repository: public.ecr.aws/w0m4q9l7/github-awslabs-smithy-rs-ci
 
+permissions:
+  actions: read
+  contents: read
+  id-token: write
+  pull-requests: read
+
 jobs:
   # Build and upload the Docker build image if necessary
   acquire-base-image:
@@ -30,6 +36,7 @@ jobs:
       id-token: write
       contents: read
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - name: Checkout
       uses: actions/checkout@v4
     - name: Acquire credentials
diff --git a/.github/workflows/ci-merge-queue.yml b/.github/workflows/ci-merge-queue.yml
index 586098f2842..761d0ae0a65 100644
--- a/.github/workflows/ci-merge-queue.yml
+++ b/.github/workflows/ci-merge-queue.yml
@@ -16,6 +16,12 @@ concurrency:
 env:
   ecr_repository: public.ecr.aws/w0m4q9l7/github-awslabs-smithy-rs-ci
 
+permissions:
+  actions: read
+  contents: read
+  id-token: write
+  pull-requests: read
+
 jobs:
   # This job will, if possible, save a docker login password to the job outputs. The token will
   # be encrypted with the passphrase stored as a GitHub secret. The login password expires after 12h.
@@ -31,6 +37,7 @@ jobs:
     continue-on-error: true
     runs-on: ubuntu-latest
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - name: Attempt to load a docker login password
       uses: aws-actions/configure-aws-credentials@v4
       with:
@@ -60,6 +67,7 @@ jobs:
       id-token: write
       contents: read
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - uses: actions/checkout@v4
       with:
         path: smithy-rs
diff --git a/.github/workflows/ci-pr-forks.yml b/.github/workflows/ci-pr-forks.yml
index e9bb85636de..ad8332fbbd0 100644
--- a/.github/workflows/ci-pr-forks.yml
+++ b/.github/workflows/ci-pr-forks.yml
@@ -12,6 +12,12 @@ concurrency:
   group: ci-forks-yaml-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  actions: read
+  contents: read
+  id-token: write
+  pull-requests: read
+
 jobs:
   # This job detects if the PR made changes to build tools. If it did, then it builds a new
   # build Docker image. Otherwise, it downloads a build image from Public ECR. In both cases,
@@ -19,9 +25,13 @@ jobs:
   acquire-base-image:
     name: Acquire Base Image
     if: ${{ github.event.pull_request.head.repo.full_name != 'smithy-lang/smithy-rs' }}
+    permissions:
+      id-token: write
+      contents: read
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - uses: actions/checkout@v4
       with:
         path: smithy-rs
diff --git a/.github/workflows/ci-pr.yml b/.github/workflows/ci-pr.yml
index 67aaf0e432b..d6c8215ca68 100644
--- a/.github/workflows/ci-pr.yml
+++ b/.github/workflows/ci-pr.yml
@@ -15,6 +15,12 @@ concurrency:
 env:
   ecr_repository: public.ecr.aws/w0m4q9l7/github-awslabs-smithy-rs-ci
 
+permissions:
+  actions: read
+  contents: read
+  id-token: write
+  pull-requests: write
+
 jobs:
   # This job will, if possible, save a docker login password to the job outputs. The token will
   # be encrypted with the passphrase stored as a GitHub secret. The login password expires after 12h.
@@ -31,6 +37,7 @@ jobs:
     continue-on-error: true
     runs-on: ubuntu-latest
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - name: Attempt to load a docker login password
       uses: aws-actions/configure-aws-credentials@v4
       with:
@@ -45,7 +52,6 @@ jobs:
         )
         echo "docker-login-password=$ENCRYPTED_PAYLOAD" >> $GITHUB_OUTPUT
 
-
   # This job detects if the PR made changes to build tools. If it did, then it builds a new
   # build Docker image. Otherwise, it downloads a build image from Public ECR. In both cases,
   # it uploads the image as a build artifact for other jobs to download and use.
@@ -62,6 +68,7 @@ jobs:
       id-token: write
       contents: read
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - uses: actions/checkout@v4
       with:
         path: smithy-rs
@@ -112,6 +119,8 @@ jobs:
 
   semver-checks:
     name: Check PR semver compliance
+    permissions:
+      pull-requests: read
     runs-on: smithy_ubuntu-latest_8-core
     timeout-minutes: 20
     needs:
@@ -124,6 +133,7 @@ jobs:
       !contains(needs.*.result, 'failure') &&
       !contains(needs.*.result, 'cancelled')
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - uses: actions/checkout@v4
       with:
         path: smithy-rs
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a55616139b8..c9723ce3626 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -56,6 +56,7 @@ jobs:
         - action: generate-aws-sdk-smoketest
         - action: generate-smithy-rs-release
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - uses: actions/checkout@v4
       with:
         path: smithy-rs
@@ -127,6 +128,7 @@ jobs:
         - action: check-deterministic-codegen
           runner: smithy_ubuntu-latest_8-core
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - uses: actions/checkout@v4
       with:
         path: smithy-rs
@@ -144,6 +146,7 @@ jobs:
     runs-on: smithy_ubuntu-latest_8-core
     timeout-minutes: 30
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - uses: actions/checkout@v4
       with:
         path: smithy-rs
@@ -188,6 +191,7 @@ jobs:
         - action: check-aws-sdk-standalone-integration-tests
           runner: ubuntu-latest
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - uses: actions/checkout@v4
       with:
         path: smithy-rs
@@ -266,6 +270,7 @@ jobs:
           test_aws_exclude: --exclude aws-inlineable
           test_smithy_rs_exclude: --exclude aws-smithy-http-server-python --exclude aws-smithy-http-server-typescript --exclude aws-smithy-experimental --exclude aws-smithy-http-client
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - name: Checkout
       uses: actions/checkout@v4
       with:
@@ -343,7 +348,10 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      actions: read
+      pull-requests: read
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - uses: actions/checkout@v4
       with:
         path: smithy-rs
@@ -368,6 +376,7 @@ jobs:
     if: ${{ !inputs.run_canary }}
     runs-on: ubuntu-latest
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - run: |
         echo "PR bot and canary cannot be invoked from a forked repository. Ask a maintainer to manually invoke them using your PR."
         exit 1
@@ -387,6 +396,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Matrix Success
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - name: Verify jobs succeeded
       # Pinned to commit hash of v1.2.2
       uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe
diff --git a/.github/workflows/claim-crate-names.yml b/.github/workflows/claim-crate-names.yml
index bc98bb09b21..b59e5c69294 100644
--- a/.github/workflows/claim-crate-names.yml
+++ b/.github/workflows/claim-crate-names.yml
@@ -25,6 +25,7 @@ jobs:
     name: Check that workflow is running in main
     runs-on: ubuntu-latest
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - name: Main branch check
       if: ${{ github.ref_name != 'main' }}
       uses: actions/github-script@v7
@@ -35,10 +36,14 @@ jobs:
   # This job will be a no-op if an image was already built on main by another workflow.
   acquire-base-image:
     name: Acquire Base Image
+    permissions:
+      id-token: write
+      contents: read
     needs:
     - main-branch-check
     runs-on: ubuntu-latest
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - uses: actions/checkout@v4
       with:
         path: smithy-rs
@@ -60,6 +65,7 @@ jobs:
     - acquire-base-image
     runs-on: ubuntu-latest
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - name: Install Rust
       uses: dtolnay/rust-toolchain@master
       with:
diff --git a/.github/workflows/credentials-verification.yml b/.github/workflows/credentials-verification.yml
index 4b83b9ba1ab..09dd6ce4d29 100644
--- a/.github/workflows/credentials-verification.yml
+++ b/.github/workflows/credentials-verification.yml
@@ -12,6 +12,7 @@ jobs:
     if: github.repository == 'smithy-lang/smithy-rs'
     runs-on: ubuntu-latest
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - name: Checkout smithy-rs
       uses: actions/checkout@v4
     - name: Verify Crates.io Token
@@ -38,6 +39,7 @@ jobs:
     if: github.repository == 'smithy-lang/smithy-rs'
     runs-on: ubuntu-latest
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - name: Checkout smithy-rs
         # To test the validity of the personal access token, we only need to perform checkout with the specified token.
       uses: actions/checkout@v4
diff --git a/.github/workflows/dry-run-release-scheduled.yml b/.github/workflows/dry-run-release-scheduled.yml
index 41d32bd53c1..2c6ad6ed37a 100644
--- a/.github/workflows/dry-run-release-scheduled.yml
+++ b/.github/workflows/dry-run-release-scheduled.yml
@@ -11,6 +11,12 @@ on:
     # Runs 00:00 UTC every day
   - cron: 0 0 * * *
 
+permissions:
+  actions: read
+  contents: read
+  id-token: write
+  pull-requests: read
+
 jobs:
   smithy-rs-scheduled-dry-run-release:
     name: Scheduled dry-run release
diff --git a/.github/workflows/dry-run-release.yml b/.github/workflows/dry-run-release.yml
index 385a389a4ab..9c7921bb25e 100644
--- a/.github/workflows/dry-run-release.yml
+++ b/.github/workflows/dry-run-release.yml
@@ -22,6 +22,12 @@ on:
         type: boolean
         default: true
 
+permissions:
+  actions: read
+  contents: read
+  id-token: write
+  pull-requests: read
+
 jobs:
   smithy-rs-manual-dry-run-release:
     name: Manual dry run release
diff --git a/.github/workflows/github-pages.yml b/.github/workflows/github-pages.yml
index 8cb73042104..b51f18a500e 100644
--- a/.github/workflows/github-pages.yml
+++ b/.github/workflows/github-pages.yml
@@ -20,6 +20,7 @@ jobs:
     if: github.repository == 'smithy-lang/smithy-rs'
     runs-on: ubuntu-latest
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - name: Checkout
       uses: actions/checkout@v4
       with:
diff --git a/.github/workflows/manual-canary.yml b/.github/workflows/manual-canary.yml
index ce720b17582..a1459ba32be 100644
--- a/.github/workflows/manual-canary.yml
+++ b/.github/workflows/manual-canary.yml
@@ -24,6 +24,7 @@ jobs:
     name: Get PR info
     runs-on: ubuntu-latest
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - name: Get PR info
       id: get-pr-info
       uses: actions/github-script@v7
@@ -47,10 +48,14 @@ jobs:
 
   acquire-base-image:
     name: Acquire Base Image
+    permissions:
+      id-token: write
+      contents: read
     needs:
     - get-pr-info
     runs-on: ubuntu-latest
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - uses: actions/checkout@v4
       with:
         path: smithy-rs
@@ -75,6 +80,7 @@ jobs:
     - get-pr-info
     runs-on: smithy_ubuntu-latest_8-core
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - uses: actions/checkout@v4
       with:
         path: smithy-rs
@@ -94,6 +100,7 @@ jobs:
       id-token: write
       contents: read
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - uses: actions/checkout@v4
       with:
         path: smithy-rs
diff --git a/.github/workflows/manual-pull-request-bot.yml b/.github/workflows/manual-pull-request-bot.yml
index bcad14be3b1..e16838ce093 100644
--- a/.github/workflows/manual-pull-request-bot.yml
+++ b/.github/workflows/manual-pull-request-bot.yml
@@ -13,11 +13,17 @@ on:
         required: true
         type: string
 
+permissions:
+  id-token: write
+  pull-requests: write
+  contents: read
+
 jobs:
   get-pr-info:
     name: Get PR info
     runs-on: ubuntu-latest
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - name: Get PR info
       id: get-pr-info
       uses: actions/github-script@v7
@@ -45,10 +51,14 @@ jobs:
   # it uploads the image as a build artifact for other jobs to download and use.
   acquire-base-image:
     name: Acquire Base Image
+    permissions:
+      id-token: write
+      contents: read
     needs:
     - get-pr-info
     runs-on: ubuntu-latest
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - uses: actions/checkout@v4
       with:
         path: smithy-rs
diff --git a/.github/workflows/manual-update-lockfiles.yml b/.github/workflows/manual-update-lockfiles.yml
index b87b5091305..e4581217df5 100644
--- a/.github/workflows/manual-update-lockfiles.yml
+++ b/.github/workflows/manual-update-lockfiles.yml
@@ -16,6 +16,10 @@ on:
         type: boolean
         default: false
 
+permissions:
+  contents: read
+  id-token: write
+
 concurrency:
   group: ${{ github.workflow }}-${{ inputs.base_branch }}
   cancel-in-progress: true
diff --git a/.github/workflows/prod-release.yml b/.github/workflows/prod-release.yml
index a479a8ab16c..0264cbd5432 100644
--- a/.github/workflows/prod-release.yml
+++ b/.github/workflows/prod-release.yml
@@ -17,6 +17,12 @@ on:
         required: true
         type: string
 
+permissions:
+  actions: read
+  contents: read
+  id-token: write
+  pull-requests: read
+
 jobs:
   smithy-rs-prod-release:
     name: Prod release
diff --git a/.github/workflows/pull-request-bot.yml b/.github/workflows/pull-request-bot.yml
index 7bdb5f7918f..5bf30db5f05 100644
--- a/.github/workflows/pull-request-bot.yml
+++ b/.github/workflows/pull-request-bot.yml
@@ -46,6 +46,7 @@ jobs:
     outputs:
       bot-message: ${{ steps.generate-diff.outputs.bot-message }}
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - uses: actions/checkout@v4
       with:
         path: smithy-rs
@@ -147,6 +148,7 @@ jobs:
       contents: read
       pull-requests: write
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - uses: actions/checkout@v4
       with:
         path: smithy-rs
diff --git a/.github/workflows/pull-request-updating-lockfiles.yml b/.github/workflows/pull-request-updating-lockfiles.yml
index 1b9b2c1bf3d..ed7106b1ffe 100644
--- a/.github/workflows/pull-request-updating-lockfiles.yml
+++ b/.github/workflows/pull-request-updating-lockfiles.yml
@@ -38,6 +38,7 @@ jobs:
     continue-on-error: true
     runs-on: ubuntu-latest
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - name: Attempt to load a docker login password
       uses: aws-actions/configure-aws-credentials@v4
       with:
@@ -64,6 +65,7 @@ jobs:
       id-token: write
       contents: read
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - uses: actions/checkout@v4
       with:
         path: smithy-rs
@@ -91,6 +93,7 @@ jobs:
     - acquire-base-image
     runs-on: ubuntu-latest
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - name: Checkout smithy-rs
       uses: actions/checkout@v4
       with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4678c6ab9f3..0d923784048 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -46,6 +46,7 @@ jobs:
     env:
       ACTOR: ${{ github.actor }}
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - name: Check actor for prod run
       run: |
         set -e
@@ -63,6 +64,9 @@ jobs:
   # This job will be a no-op if an image had already been built.
   acquire-base-image:
     name: Acquire Base Image
+    permissions:
+      id-token: write
+      contents: read
     needs:
     - check-actor-for-prod-run
     # We need `always` here otherwise this job won't run if the previous job has been skipped
@@ -72,6 +76,7 @@ jobs:
       (needs.check-actor-for-prod-run.result == 'success' || needs.check-actor-for-prod-run.result == 'skipped')
     runs-on: smithy_ubuntu-latest_16-core
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - uses: actions/checkout@v4
       with:
         path: smithy-rs
@@ -110,6 +115,7 @@ jobs:
     if: always()
     runs-on: smithy_ubuntu-latest_8-core
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - uses: actions/checkout@v4
       with:
         path: smithy-rs
@@ -143,6 +149,7 @@ jobs:
       release_branch: ${{ steps.branch-push.outputs.release_branch }}
       new_release_series: ${{ steps.branch-push.outputs.new_release_series }}
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - uses: actions/checkout@v4
       with:
         ref: ${{ inputs.commit_sha }}
@@ -171,6 +178,7 @@ jobs:
       !contains(needs.*.result, 'cancelled')
     runs-on: ubuntu-latest
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - name: Install Rust
       uses: dtolnay/rust-toolchain@master
       with:
diff --git a/.github/workflows/update-lockfiles.yml b/.github/workflows/update-lockfiles.yml
index 28fe0bee8f7..da8997ceade 100644
--- a/.github/workflows/update-lockfiles.yml
+++ b/.github/workflows/update-lockfiles.yml
@@ -8,6 +8,10 @@ on:
     # Runs 22:00 UTC every Tuesday
   - cron: 0 22 * * 2
 
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
   cargo-update-runtime-lockfiles-and-sdk-lockfile:
     name: Run cargo update on the runtime lockfiles and the SDK lockfile
diff --git a/.github/workflows/update-sdk-next.yml b/.github/workflows/update-sdk-next.yml
index b5c09539338..3829bfa7a1b 100644
--- a/.github/workflows/update-sdk-next.yml
+++ b/.github/workflows/update-sdk-next.yml
@@ -22,6 +22,7 @@ jobs:
     name: Update `next`
     runs-on: ubuntu-latest
     steps:
+    - uses: GitHubSecurityLab/actions-permissions/monitor@v1
     - name: Check out `smithy-rs`
       uses: actions/checkout@v4
       with:


Reviews:
user: login: ysaito1001
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-08T15:01:55Z
user: login: landonxjames
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-08T16:27:36Z
user: login: ysaito1001
body: Must've been painful to go through all of these. Thanks for the update!
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-04-08T17:37:43Z

Review comments:
diff_hunk: @@ -11,6 +11,12 @@ on:
     # Runs 00:00 UTC every day
   - cron: 0 0 * * *
 
+permissions:
+  actions: read
+  contents: read
+  id-token: write
+  pull-requests: read
path: .github/workflows/dry-run-release-scheduled.yml
user: login: ysaito1001
body: Just to educate myself, what's the reason for `pull-requests` to be set to `read` when it was previously `none`? Does that mean the workflow needs to read metadata for a pull request?
created_at: 2025-04-08T15:01:55Z
author_association: CONTRIBUTOR
diff_hunk: @@ -11,6 +11,12 @@ on:
     # Runs 00:00 UTC every day
   - cron: 0 0 * * *
 
+permissions:
+  actions: read
+  contents: read
+  id-token: write
+  pull-requests: read
path: .github/workflows/dry-run-release-scheduled.yml
user: login: landonxjames
body: It is because the dry-run release calls `release.yml` which in turn invokes `ci.yml` which needs the `pull-request` permission. The GH permissions of the parent job are inherited by the child job and even if that child job skips the step that actually uses that permission it still needs it from the parent. 

Interestingly I believe it was previously set to `write` rather than `none` since our previous default token permissions were set to:

>**Read and write permissions**
>Workflows have read and write permissions in the repository for all scopes.

As a side note, I think I will probably have to increase the `pull-request` permissions to `write` since the prod release will need that to cut the backport PR and prod/dry-run release both share the underlying `release.yml` action definition. Going to attempt a prod release once this is merged to finalize those permissions.

created_at: 2025-04-08T16:27:36Z
author_association: CONTRIBUTOR

PR comments:
user: login: github-actions[bot]
created_at: 2025-04-04T03:49:35Z
body: A new generated diff is ready to view.
- No codegen difference in the AWS SDK
- No codegen difference in the Client Test
- No codegen difference in the Server Test
- No codegen difference in the Server Test Python
- No codegen difference in the Server Test Typescript


A [new doc preview](https://d2luzm2xt3nokh.cloudfront.net/docs/90a47d96011b3d76a66c94c909a6822cdc52b2e1/index.html) is ready to view.


author_association: NONE
user: login: github-actions[bot]
created_at: 2025-04-04T18:54:02Z
body: A new generated diff is ready to view.
- No codegen difference in the AWS SDK
- No codegen difference in the Client Test
- No codegen difference in the Server Test
- No codegen difference in the Server Test Python
- No codegen difference in the Server Test Typescript


A [new doc preview](https://d2luzm2xt3nokh.cloudfront.net/docs/74d0bbc46eace89e15f93f229f3f2f87fb59fba0/index.html) is ready to view.


author_association: NONE
user: login: github-actions[bot]
created_at: 2025-04-04T20:37:17Z
body: A new generated diff is ready to view.
- No codegen difference in the AWS SDK
- No codegen difference in the Client Test
- No codegen difference in the Server Test
- No codegen difference in the Server Test Python
- No codegen difference in the Server Test Typescript


A [new doc preview](https://d2luzm2xt3nokh.cloudfront.net/docs/3be0740febb5c1e16be7f0e6eb499f72a41c735d/index.html) is ready to view.


author_association: NONE
user: login: github-actions[bot]
created_at: 2025-04-04T21:16:39Z
body: A new generated diff is ready to view.
- No codegen difference in the AWS SDK
- No codegen difference in the Client Test
- No codegen difference in the Server Test
- No codegen difference in the Server Test Python
- No codegen difference in the Server Test Typescript


A [new doc preview](https://d2luzm2xt3nokh.cloudfront.net/docs/a5fe8da63095cac9627de927a15ef56f2c246da1/index.html) is ready to view.


author_association: NONE
user: login: github-actions[bot]
created_at: 2025-04-06T02:04:05Z
body: A new generated diff is ready to view.
- No codegen difference in the AWS SDK
- No codegen difference in the Client Test
- No codegen difference in the Server Test
- No codegen difference in the Server Test Python
- No codegen difference in the Server Test Typescript


A [new doc preview](https://d2luzm2xt3nokh.cloudfront.net/docs/46cf97903078e608864ef9f91fc9ce1f1dd33ee5/index.html) is ready to view.


author_association: NONE
user: login: github-actions[bot]
created_at: 2025-04-06T02:29:41Z
body: A new generated diff is ready to view.
- No codegen difference in the AWS SDK
- No codegen difference in the Client Test
- No codegen difference in the Server Test
- No codegen difference in the Server Test Python
- No codegen difference in the Server Test Typescript


A [new doc preview](https://d2luzm2xt3nokh.cloudfront.net/docs/0a72b0acc4477084c238038db07fdfab9dd5bedc/index.html) is ready to view.


author_association: NONE
user: login: github-actions[bot]
created_at: 2025-04-06T03:29:16Z
body: A new generated diff is ready to view.
- No codegen difference in the AWS SDK
- No codegen difference in the Client Test
- No codegen difference in the Server Test
- No codegen difference in the Server Test Python
- No codegen difference in the Server Test Typescript


A [new doc preview](https://d2luzm2xt3nokh.cloudfront.net/docs/90dade3fb017f44d1076ef4691fa9e1b189776bc/index.html) is ready to view.


author_association: NONE
user: login: github-actions[bot]
created_at: 2025-04-06T04:35:15Z
body: A new generated diff is ready to view.
- No codegen difference in the AWS SDK
- No codegen difference in the Client Test
- No codegen difference in the Server Test
- No codegen difference in the Server Test Python
- No codegen difference in the Server Test Typescript


A [new doc preview](https://d2luzm2xt3nokh.cloudfront.net/docs/5a8c4d98f2388e6ff9e0e816772df80eeb1f4864/index.html) is ready to view.


author_association: NONE
user: login: github-actions[bot]
created_at: 2025-04-07T03:45:55Z
body: A new generated diff is ready to view.
- No codegen difference in the AWS SDK
- No codegen difference in the Client Test
- No codegen difference in the Server Test
- No codegen difference in the Server Test Python
- No codegen difference in the Server Test Typescript


A [new doc preview](https://d2luzm2xt3nokh.cloudfront.net/docs/826d5386c1cac4e4e0ea94c5552c4db99102c317/index.html) is ready to view.


author_association: NONE