From 277444f1f14a8ec333a4e97ce66e13bb91c0335a Mon Sep 17 00:00:00 2001
From: Aswin Zayasankaran <156493059+Aswinmcw@users.noreply.github.com>
Date: Sun, 5 Jul 2026 08:18:45 +0000
Subject: [PATCH] ci: pin auto-approve caller to permissions: {}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Parity with the other repos — the caller job needs no GITHUB_TOKEN of its own
(the reusable workflow mints its own App token). Fixes CodeQL 'Workflow does
not contain permissions'.
---
 .github/workflows/auto-approve.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/auto-approve.yml b/.github/workflows/auto-approve.yml
index 10aebb4..064a08e 100644
--- a/.github/workflows/auto-approve.yml
+++ b/.github/workflows/auto-approve.yml
@@ -6,6 +6,10 @@ on:
   pull_request_target:
     types: [opened, reopened, ready_for_review, synchronize]
 
+# This caller job needs no token of its own — the reusable workflow mints its
+# own App token and uses the org PAT. Pin to none for least privilege.
+permissions: {}
+
 concurrency:
   group: auto-approve-${{ github.event.pull_request.number }}
   cancel-in-progress: true