From cbddc7ba24fae0022fb01900c6a62e8d1c5ddefd Mon Sep 17 00:00:00 2001
From: Rishav karanjit <karanjitrishav4@gmail.com>
Date: Thu, 5 Feb 2026 10:32:30 -0800
Subject: [PATCH 1/5] chore: fix permissions of CI workflows

---
 .github/workflows/daily_ci.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/daily_ci.yml b/.github/workflows/daily_ci.yml
index 79b796bc49..6134f2a1e3 100644
--- a/.github/workflows/daily_ci.yml
+++ b/.github/workflows/daily_ci.yml
@@ -1,9 +1,16 @@
 # This workflow runs every weekday at 16:00 UTC (9AM PDT)
 name: Daily CI
 
+permissions:
+  contents: read
+  id-token: write
+  
 on:
   schedule:
     - cron: "00 16 * * 1-5"
+  pull_request:
+    paths:
+      .github/workflows/daily_ci.yml
 
 jobs:
   getVersion:

From 035b53772f6fd5ad25d3503788fdfd4710fb094a Mon Sep 17 00:00:00 2001
From: Rishav karanjit <karanjitrishav4@gmail.com>
Date: Thu, 5 Feb 2026 10:41:14 -0800
Subject: [PATCH 2/5] Update pull.yml to include permissions

Add permissions for contents and id-token in PR CI workflow
---
 .github/workflows/pull.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/pull.yml b/.github/workflows/pull.yml
index 3f237ee0d0..7038076c45 100644
--- a/.github/workflows/pull.yml
+++ b/.github/workflows/pull.yml
@@ -1,6 +1,10 @@
 # This workflow runs for every pull request
 name: PR CI
 
+permissions:
+  contents: read
+  id-token: write
+  
 on:
   pull_request:
 

From 1c6ba6efd0f101908b7d31567a6bd12edc2ae8c7 Mon Sep 17 00:00:00 2001
From: Rishav karanjit <karanjitrishav4@gmail.com>
Date: Thu, 5 Feb 2026 10:42:16 -0800
Subject: [PATCH 3/5] Add permissions to GitHub Actions workflow

---
 .github/workflows/push.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index 9e49cf1338..ababdeb051 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -6,6 +6,10 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
   getVersion:
     uses: ./.github/workflows/dafny_version.yml

From 07ed16d36bc75ecdf18b6ff521a324597ca3f156 Mon Sep 17 00:00:00 2001
From: Rishav karanjit <karanjitrishav4@gmail.com>
Date: Thu, 5 Feb 2026 10:46:15 -0800
Subject: [PATCH 4/5] Update Slack notification condition for daily CI

---
 .github/workflows/daily_ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/daily_ci.yml b/.github/workflows/daily_ci.yml
index 6134f2a1e3..a0ed7160ea 100644
--- a/.github/workflows/daily_ci.yml
+++ b/.github/workflows/daily_ci.yml
@@ -95,7 +95,7 @@ jobs:
         daily-ci-net-test-vectors,
         daily-ci-net-examples,
       ]
-    if: ${{ failure() }}
+    if: ${{ failure() && github.event_name == 'schedule' }}
     uses: aws/aws-cryptographic-material-providers-library/.github/workflows/slack-notification.yml@main
     with:
       message: "Daily CI failed on `${{ github.repository }}`. View run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"

From a1d8166ca4e99df1f0de728874f2401fb9c959ae Mon Sep 17 00:00:00 2001
From: rishav-karanjit <rishavkj@amazon.com>
Date: Thu, 5 Feb 2026 10:51:53 -0800
Subject: [PATCH 5/5] formatting

---
 .github/workflows/daily_ci.yml | 5 ++---
 .github/workflows/pull.yml     | 2 +-
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/daily_ci.yml b/.github/workflows/daily_ci.yml
index a0ed7160ea..254d8fc690 100644
--- a/.github/workflows/daily_ci.yml
+++ b/.github/workflows/daily_ci.yml
@@ -4,13 +4,12 @@ name: Daily CI
 permissions:
   contents: read
   id-token: write
-  
+
 on:
   schedule:
     - cron: "00 16 * * 1-5"
   pull_request:
-    paths:
-      .github/workflows/daily_ci.yml
+    paths: .github/workflows/daily_ci.yml
 
 jobs:
   getVersion:
diff --git a/.github/workflows/pull.yml b/.github/workflows/pull.yml
index 7038076c45..aa95a53011 100644
--- a/.github/workflows/pull.yml
+++ b/.github/workflows/pull.yml
@@ -4,7 +4,7 @@ name: PR CI
 permissions:
   contents: read
   id-token: write
-  
+
 on:
   pull_request: