chore: add pull-requests: write to new job-level permissions

Author: texastony

.github/workflows/ci_codegen.yml

@@ -12,6 +12,7 @@ jobs:
   code-generation:
     permissions:
       contents: read
+      pull-requests: write
     strategy:
       fail-fast: false
       matrix:

.github/workflows/ci_duvet.yml

@@ -13,6 +13,7 @@ jobs:
   duvet:
     permissions:
       contents: read
+      pull-requests: write
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v6

.github/workflows/ci_static_analysis.yml

@@ -11,6 +11,7 @@ jobs:
   not-grep:
     permissions:
       contents: read
+      pull-requests: write
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v6

.github/workflows/ci_todos.yml

@@ -11,6 +11,7 @@ jobs:
   findTodos:
     permissions:
       contents: read
+      pull-requests: write
     runs-on: macos-14
     steps:
       - uses: actions/checkout@v6

.github/workflows/dafny-interop.yml

@@ -24,12 +24,14 @@ jobs:
   getMplHeadVersion:
     permissions:
       contents: read
+      pull-requests: write
     uses: ./.github/workflows/mpl_head_version.yml
     with:
       mpl-head: ${{inputs.mpl-commit}}
   dafny-interop-java:
     permissions:
       contents: read
+      pull-requests: write
     needs: getMplHeadVersion
     uses: ./.github/workflows/dafny_interop_java.yml
     with:
@@ -40,6 +42,7 @@ jobs:
   dafny-interop-java-test-vectors:
     permissions:
       contents: read
+      pull-requests: write
     needs: getMplHeadVersion
     uses: ./.github/workflows/dafny_interop_test_vector_java.yml
     with:
@@ -50,6 +53,7 @@ jobs:
   dafny-interop-java-examples:
     permissions:
       contents: read
+      pull-requests: write
     needs: getMplHeadVersion
     uses: ./.github/workflows/dafny_interop_examples_java.yml
     with:
@@ -60,6 +64,7 @@ jobs:
   dafny-interop-net:
     permissions:
       contents: read
+      pull-requests: write
     uses: ./.github/workflows/dafny_interop_test_net.yml
     with:
       mpl-dafny: ${{inputs.mpl-dafny}}
@@ -68,6 +73,7 @@ jobs:
   dafny-interop-net-test-vectors:
     permissions:
       contents: read
+      pull-requests: write
     uses: ./.github/workflows/dafny_interop_test_vector_net.yml
     with:
       mpl-dafny: ${{inputs.mpl-dafny}}
@@ -76,6 +82,7 @@ jobs:
   dafny-interop-net-examples:
     permissions:
       contents: read
+      pull-requests: write
     uses: ./.github/workflows/dafny_interop_examples_net.yml
     with:
       mpl-dafny: ${{inputs.mpl-dafny}}

.github/workflows/dafny_verify_version.yml

@@ -14,6 +14,7 @@ jobs:
   getDafnyVerifyVersion:
     permissions:
       contents: read
+      pull-requests: write
     runs-on: ubuntu-22.04
     outputs:
       version: ${{ steps.read_property.outputs.dafnyVerifyVersion }}

.github/workflows/dafny_version.yml

@@ -14,6 +14,7 @@ jobs:
   getDafnyVersion:
     permissions:
       contents: read
+      pull-requests: write
     runs-on: ubuntu-22.04
     outputs:
       version: ${{ steps.read_property.outputs.dafnyVersion }}

.github/workflows/daily_ci.yml

@@ -15,17 +15,20 @@ jobs:
   getVersion:
     permissions:
       contents: read
+      pull-requests: write
     # Don't run the cron builds on forks
     if: github.event_name != 'schedule' || github.repository_owner == 'aws'
     uses: ./.github/workflows/dafny_version.yml
   getVerifyVersion:
     permissions:
       contents: read
+      pull-requests: write
     if: github.event_name != 'schedule' || github.repository_owner == 'aws'
     uses: ./.github/workflows/dafny_verify_version.yml
   daily-ci-format:
     permissions:
       contents: read
+      pull-requests: write
     needs: getVersion
     if: github.event_name != 'schedule' || github.repository_owner == 'aws'
     uses: ./.github/workflows/library_format.yml
@@ -34,6 +37,7 @@ jobs:
   daily-ci-codegen:
     permissions:
       contents: read
+      pull-requests: write
     needs: getVersion
     if: github.event_name != 'schedule' || github.repository_owner == 'aws'
     uses: ./.github/workflows/ci_codegen.yml
@@ -42,6 +46,7 @@ jobs:
   daily-ci-verification:
     permissions:
       contents: read
+      pull-requests: write
     needs: getVerifyVersion
     if: github.event_name != 'schedule' || github.repository_owner == 'aws'
     uses: ./.github/workflows/library_dafny_verification.yml
@@ -50,62 +55,71 @@ jobs:
   daily-ci-test-vector-verification:
     permissions:
       contents: read
+      pull-requests: write
     needs: getVerifyVersion
     uses: ./.github/workflows/test_vector_verification.yml
     with:
       dafny: ${{needs.getVerifyVersion.outputs.version}}
   daily-ci-java:
     permissions:
       contents: read
+      pull-requests: write
     needs: getVersion
     uses: ./.github/workflows/ci_test_java.yml
     with:
       dafny: ${{needs.getVersion.outputs.version}}
   daily-ci-java-test-vectors:
     permissions:
       contents: read
+      pull-requests: write
     needs: getVersion
     uses: ./.github/workflows/ci_test_vector_java.yml
     with:
       dafny: ${{needs.getVersion.outputs.version}}
   daily-ci-java-examples:
     permissions:
       contents: read
+      pull-requests: write
     needs: getVersion
     uses: ./.github/workflows/ci_examples_java.yml
     with:
       dafny: ${{needs.getVersion.outputs.version}}
   daily-ci-net:
     permissions:
       contents: read
+      pull-requests: write
     needs: getVersion
     uses: ./.github/workflows/ci_test_net.yml
     with:
       dafny: ${{needs.getVersion.outputs.version}}
   daily-ci-rust:
     permissions:
       contents: read
+      pull-requests: write
     needs: getVersion
     uses: ./.github/workflows/library_rust_tests.yml
     with:
       dafny: ${{needs.getVersion.outputs.version}}
   daily-ci-net-test-vectors:
     permissions:
       contents: read
+      pull-requests: write
     needs: getVersion
     uses: ./.github/workflows/ci_test_vector_net.yml
     with:
       dafny: ${{needs.getVersion.outputs.version}}
   daily-ci-net-examples:
     permissions:
       contents: read
+      pull-requests: write
     needs: getVersion
     uses: ./.github/workflows/ci_examples_net.yml
     with:
       dafny: ${{needs.getVersion.outputs.version}}
   notify:
     permissions:
       contents: read
+      pull-requests: write
     needs:
       [
         getVersion,

.github/workflows/go-release.yml

@@ -16,6 +16,7 @@ jobs:
   get-dafny-version:
     permissions:
       contents: read
+      pull-requests: write
     uses: ./.github/workflows/dafny_version.yml
 
   go-release:

.github/workflows/issue-notification.yml

@@ -9,6 +9,7 @@ jobs:
   notify-issue:
     permissions:
       contents: read
+      pull-requests: write
     if: github.event_name == 'issues'
     uses: aws/aws-cryptographic-material-providers-library/.github/workflows/slack-notification.yml@main
     with:
@@ -19,6 +20,7 @@ jobs:
   notify-comment:
     permissions:
       contents: read
+      pull-requests: write
     if: github.event_name == 'issue_comment' && !github.event.issue.pull_request
     uses: aws/aws-cryptographic-material-providers-library/.github/workflows/slack-notification.yml@main
     with: