From d6a20ddc909fe4d46f250dfa9a343998b914157d Mon Sep 17 00:00:00 2001
From: Connor-Meybohm <Connor.Meybohm@ibm.com>
Date: Tue, 15 Sep 2026 09:34:15 -0400
Subject: [PATCH] [llvm-build.yml] Changed write permissions to be at the job
 level

Signed-off-by: Connor-Meybohm <Connor.Meybohm@ibm.com>
---
 .github/workflows/llvm-build.yml | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/llvm-build.yml b/.github/workflows/llvm-build.yml
index f469aab..52f47a6 100644
--- a/.github/workflows/llvm-build.yml
+++ b/.github/workflows/llvm-build.yml
@@ -22,8 +22,9 @@ on:
         type: string
 
 # Release create/upload/delete (publishing the LLVM build as a release asset).
+# Write permissions given at the job level now instead of at the workflow level
 permissions:
-  contents: write
+  contents: read
 
 env:
   SCCACHE_DIR: ${{ github.workspace }}/sccache
@@ -67,6 +68,8 @@ jobs:
   create-release:
     needs: get-hash
     if: ${{ github.event_name != 'pull_request' }}
+    permissions:
+      contents: write
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
@@ -91,6 +94,8 @@ jobs:
     # skip, so it also defeats the implicit success() gate on get-hash —
     # require get-hash success explicitly, and that create-release didn't fail.
     if: ${{ !cancelled() && needs.get-hash.result == 'success' && needs.create-release.result != 'failure' }}
+    permissions:
+      contents: write
     runs-on: ${{ matrix.config.runs-on }}
 
     strategy:
@@ -315,6 +320,8 @@ jobs:
     name: Refresh artifact (${{ matrix.config.runner }})
     needs: get-hash
     if: ${{ github.event_name == 'schedule' }}
+    permissions:
+      actions: write
     runs-on: ${{ matrix.config.runs-on }}
 
     strategy: