From 29bab2184db42103dd30c0827059ef3f854847d4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nuno=20Sim=C3=B5es?= <nuno.simoes@mattermost.com>
Date: Tue, 21 Apr 2026 21:25:01 +0200
Subject: [PATCH] e2e: adjust some pipeline settings (#36178)

---
 .github/workflows/e2e-tests-ci.yml                  | 7 +++++++
 .github/workflows/e2e-tests-cypress.yml             | 3 +++
 .github/workflows/e2e-tests-playwright-template.yml | 5 +++++
 .github/workflows/e2e-tests-playwright.yml          | 7 +++++++
 4 files changed, 22 insertions(+)

diff --git a/.github/workflows/e2e-tests-ci.yml b/.github/workflows/e2e-tests-ci.yml
index f4f5f62b8c3..53283c7a421 100644
--- a/.github/workflows/e2e-tests-ci.yml
+++ b/.github/workflows/e2e-tests-ci.yml
@@ -23,6 +23,9 @@ on:
         type: string
         required: false
 
+permissions:
+  contents: read
+
 jobs:
   resolve-pr:
     runs-on: ubuntu-24.04
@@ -206,6 +209,7 @@ jobs:
       - check-changes
     if: needs.resolve-pr.outputs.PR_NUMBER != ''
     permissions:
+      contents: read
       statuses: write
     uses: ./.github/workflows/e2e-tests-cypress.yml
     with:
@@ -231,6 +235,7 @@ jobs:
       - check-changes
     if: needs.resolve-pr.outputs.PR_NUMBER != ''
     permissions:
+      contents: read
       statuses: write
     uses: ./.github/workflows/e2e-tests-playwright.yml
     with:
@@ -254,6 +259,7 @@ jobs:
       - check-changes
     if: needs.resolve-pr.outputs.PR_NUMBER != '' && needs.check-changes.outputs.should_run_fips == 'true'
     permissions:
+      contents: read
       statuses: write
     uses: ./.github/workflows/e2e-tests-cypress.yml
     with:
@@ -279,6 +285,7 @@ jobs:
       - check-changes
     if: needs.resolve-pr.outputs.PR_NUMBER != '' && needs.check-changes.outputs.should_run_fips == 'true'
     permissions:
+      contents: read
       statuses: write
     uses: ./.github/workflows/e2e-tests-playwright.yml
     with:
diff --git a/.github/workflows/e2e-tests-cypress.yml b/.github/workflows/e2e-tests-cypress.yml
index 485e8340e27..bacc49e9d62 100644
--- a/.github/workflows/e2e-tests-cypress.yml
+++ b/.github/workflows/e2e-tests-cypress.yml
@@ -62,6 +62,9 @@ on:
       CWS_EXTRA_HTTP_HEADERS:
         required: false
 
+permissions:
+  contents: read
+
 jobs:
   generate-build-variables:
     runs-on: ubuntu-24.04
diff --git a/.github/workflows/e2e-tests-playwright-template.yml b/.github/workflows/e2e-tests-playwright-template.yml
index ed064758a0e..ea85110ff04 100644
--- a/.github/workflows/e2e-tests-playwright-template.yml
+++ b/.github/workflows/e2e-tests-playwright-template.yml
@@ -99,6 +99,11 @@ on:
       AWS_SECRET_ACCESS_KEY:
         required: true
 
+# Callers must grant at least these scopes on the job that uses this workflow
+permissions:
+  contents: read
+  statuses: write
+
 env:
   SERVER_IMAGE: "${{ inputs.server_image_repo }}/${{ inputs.server_edition == 'fips' && 'mattermost-enterprise-fips-edition' || inputs.server_edition == 'team' && 'mattermost-team-edition' || 'mattermost-enterprise-edition' }}:${{ inputs.server_image_tag }}"
 
diff --git a/.github/workflows/e2e-tests-playwright.yml b/.github/workflows/e2e-tests-playwright.yml
index a92bd3d0944..fb8ea9141db 100644
--- a/.github/workflows/e2e-tests-playwright.yml
+++ b/.github/workflows/e2e-tests-playwright.yml
@@ -56,6 +56,9 @@ on:
       AWS_SECRET_ACCESS_KEY:
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   generate-build-variables:
     runs-on: ubuntu-24.04
@@ -140,6 +143,7 @@ jobs:
     if: inputs.should_run == 'false'
     runs-on: ubuntu-24.04
     permissions:
+      contents: read
       statuses: write
     steps:
       - name: ci/post-skip-status
@@ -159,6 +163,9 @@ jobs:
     needs:
       - generate-build-variables
     if: inputs.should_run != 'false'
+    permissions:
+      contents: read
+      statuses: write
     uses: ./.github/workflows/e2e-tests-playwright-template.yml
     with:
       test_type: full