From d3ad80fc56f95aba9141109e50dcf4abec77d241 Mon Sep 17 00:00:00 2001
From: Navya Singh <navyasingh@microsoft.com>
Date: Tue, 13 Oct 2026 14:37:52 -0700
Subject: [PATCH] task 3070608

---
 .github/workflows/CI.yml            | 3 +++
 .github/workflows/close-preview.yml | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index bff849e3510a..7d3b2f2ae7b0 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -4,6 +4,9 @@ on:
     branches:
       - v2
 
+permissions:
+  contents: read
+
 # Ensure scripts are run with pipefail. See:
 # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
 defaults:
diff --git a/.github/workflows/close-preview.yml b/.github/workflows/close-preview.yml
index 45f80901c3ca..4d1ed526512b 100644
--- a/.github/workflows/close-preview.yml
+++ b/.github/workflows/close-preview.yml
@@ -9,6 +9,8 @@ on:
   pull_request_target:
     types: [closed]
 
+permissions: {}
+
 jobs:
   close:
     runs-on: ubuntu-latest