From f2c558139da565b5084e1dd4326d138b351d26dd Mon Sep 17 00:00:00 2001 From: pacowong Date: Fri, 10 Jul 2026 22:39:16 +0800 Subject: [PATCH 1/6] Update cffconvert.yml --- .github/workflows/cffconvert.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/cffconvert.yml b/.github/workflows/cffconvert.yml index 0cbaf24059390..9c49ed79d026e 100644 --- a/.github/workflows/cffconvert.yml +++ b/.github/workflows/cffconvert.yml @@ -5,6 +5,9 @@ on: paths: - CITATION.cff +permissions: + contents: read + jobs: validate: name: "validate" From 357e54f74f6e76f6fb5b1ff3c4e46bd908a6401f Mon Sep 17 00:00:00 2001 From: pacowong Date: Fri, 10 Jul 2026 23:02:00 +0800 Subject: [PATCH 2/6] Update generate-xcframework-maccatalyst.yml --- .github/workflows/generate-xcframework-maccatalyst.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/generate-xcframework-maccatalyst.yml b/.github/workflows/generate-xcframework-maccatalyst.yml index 25b2b9bb761d9..4106fe3a33187 100644 --- a/.github/workflows/generate-xcframework-maccatalyst.yml +++ b/.github/workflows/generate-xcframework-maccatalyst.yml @@ -9,6 +9,9 @@ on: env: python_version: 3.11 +permissions: + contents: read + jobs: build_macabi_xcf: name: build_${{ matrix.variant }}_xcf From aeab10fdb8ca1af335dc7dc0fd6ebfa507ab36eb Mon Sep 17 00:00:00 2001 From: pacowong Date: Fri, 10 Jul 2026 23:02:35 +0800 Subject: [PATCH 3/6] Update gradle-wrapper-validation.yml --- .github/workflows/gradle-wrapper-validation.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/gradle-wrapper-validation.yml b/.github/workflows/gradle-wrapper-validation.yml index a8726aaa7497e..5b23fe29b5528 100644 --- a/.github/workflows/gradle-wrapper-validation.yml +++ b/.github/workflows/gradle-wrapper-validation.yml @@ -5,6 +5,9 @@ name: "Validate Gradle Wrapper" on: [push, pull_request] +permissions: + contents: read + jobs: validation: name: "Validation" From d92c445ec92df7fce6181eb2bccadc2b1384ba89 Mon Sep 17 00:00:00 2001 From: pacowong Date: Fri, 10 Jul 2026 23:03:02 +0800 Subject: [PATCH 4/6] Update mac.yml --- .github/workflows/mac.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/mac.yml b/.github/workflows/mac.yml index e99f16afe700c..a84d16d88b794 100644 --- a/.github/workflows/mac.yml +++ b/.github/workflows/mac.yml @@ -18,6 +18,9 @@ concurrency: env: python_version: 3.11 +permissions: + contents: read + jobs: ARM64-Xcode16: runs-on: macos-15 From 47b56756d6cf5a833c649e1a93bafc930b3dddd3 Mon Sep 17 00:00:00 2001 From: pacowong Date: Fri, 10 Jul 2026 23:03:25 +0800 Subject: [PATCH 5/6] Update publish-gh-pages.yml --- .github/workflows/publish-gh-pages.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/publish-gh-pages.yml b/.github/workflows/publish-gh-pages.yml index 11745ce24f9e5..7ca453a2cc712 100644 --- a/.github/workflows/publish-gh-pages.yml +++ b/.github/workflows/publish-gh-pages.yml @@ -6,6 +6,9 @@ on: # Allows you to run this workflow manually from the Actions tab workflow_dispatch: +permissions: + contents: read + jobs: placeholder: runs-on: ["self-hosted", "1ES.Pool=onnxruntime-github-Ubuntu2204-AMD-CPU"] From eb613d40e5371adde493ee705fbef62e8fffd94e Mon Sep 17 00:00:00 2001 From: pacowong Date: Fri, 10 Jul 2026 23:03:50 +0800 Subject: [PATCH 6/6] Update windows.yml --- .github/workflows/windows.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 8ec2cbe5505c1..4b107adf8fd4e 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -14,6 +14,9 @@ env: AZCOPY_AUTO_LOGIN_TYPE: MSI AZCOPY_MSI_CLIENT_ID: 63b63039-6328-442f-954b-5a64d124e5b4 +permissions: + contents: read + jobs: Windows-CUDA-12: if: github.event_name != 'pull_request'