chore[ci]: remove unnecessarly workflow perms. (#5034)

joseph-isaacs · web-flow · commit a9fade4cec4e · 2025-10-22T14:22:12.000+01:00
Signed-off-by: Joe Isaacs &lt;joe.isaacs@live.co.uk&gt;
diff --git a/.github/workflows/bench-pr.yml b/.github/workflows/bench-pr.yml
@@ -9,11 +9,10 @@ on:
   workflow_dispatch: {}
 
 permissions:
-  actions: write
+  actions: write  # for removing labels
   contents: read
-  pull-requests: write
-  id-token: write
-  deployments: write
+  pull-requests: write  # for commenting on PRs
+  id-token: write  # enables AWS-GitHub OIDC
 
 jobs:
   label_trigger:
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
@@ -6,10 +6,7 @@ on:
   workflow_dispatch: {}
 
 permissions:
-  actions: read
-  deployments: write
-  contents: write
-  id-token: write
+  contents: read
 
 jobs:
   build:
diff --git a/.github/workflows/sql-pr.yml b/.github/workflows/sql-pr.yml
@@ -9,11 +9,10 @@ on:
   workflow_dispatch: {}
 
 permissions:
-  actions: write
+  actions: write  # for removing labels
   contents: read
-  pull-requests: write
-  id-token: write
-  deployments: write
+  pull-requests: write  # for commenting on PRs
+  id-token: write  # enables AWS-GitHub OIDC
 
 jobs:
   label_trigger:
