Merge branch '4.x' into 5.x

Author: danharrin

.github/workflows/check-pr-maintainer-access.yml

@@ -9,11 +9,12 @@ on:
 
 permissions:
   contents: read
-  pull-requests: write
 
 jobs:
   notify-when-maintainers-cannot-edit:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
     steps:
       - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:

.github/workflows/format-and-build.yml

@@ -6,7 +6,7 @@ on:
       - 5.x
 
 permissions:
-  contents: write
+  contents: read
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -16,6 +16,8 @@ jobs:
   format-and-build:
     if: "${{ !startsWith(github.event.head_commit.message, 'chore: format and build') }}"
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Checkout code
         # Uses a maintainer PAT so the auto-commit push can bypass branch protection;

.github/workflows/manage-issue.yml

@@ -6,11 +6,12 @@ on:
 
 permissions:
   contents: read
-  issues: write
 
 jobs:
   check-repro:
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
     steps:
       - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:

.github/workflows/renovate.yml

@@ -11,12 +11,14 @@ on:
         default: false
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 jobs:
   renovate:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with: