Merge remote-tracking branch 'upstream/main' into remove-children-normalization

Author: josemontespg

.github/workflows/check_license.yml

@@ -20,6 +20,9 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   check-license:
     runs-on: ubuntu-latest

.github/workflows/check_private_index.yml

@@ -18,6 +18,9 @@ on:
   push:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   check-for-private-index:
     runs-on: ubuntu-latest

.github/workflows/composer_build_and_test.yml

@@ -28,6 +28,9 @@ on:
       - "renderers/web_core/**"
       - ".github/workflows/composer_build_and_test.yml"
 
+permissions:
+  contents: read
+
 jobs:
   build-and-test:
     runs-on: ubuntu-latest

.github/workflows/e2e_test.yaml

@@ -6,14 +6,20 @@ name: E2E Tests
 
 on:
   schedule:
-    - cron: "0 * * * *" # hourly
+    - cron: "0 0 * * *" # daily
+
+permissions:
+  contents: read
 
 jobs:
   e2e_test:
     # Do not run on forked branches,
     # because the test does not have access to secrets in forks.
     if: github.repository == 'google/a2ui'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
     steps:
       - name: Check that REPO_GEMINI_API_KEY is set and available
         env:
@@ -51,3 +57,8 @@ jobs:
         env:
           GEMINI_API_KEY: ${{ secrets.REPO_GEMINI_API_KEY }}
         run: ./scripts/e2e_test.sh
+      - name: Create Issue if E2E tests fail on main branch
+        if: failure() && (github.event_name == 'push' || github.event_name == 'schedule') && github.ref == 'refs/heads/main'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: ./scripts/create_issue.sh "E2E tests" "e2e_failure"

.github/workflows/editor_build.yml

@@ -28,6 +28,9 @@ on:
       - "renderers/web_core/**"
       - ".github/workflows/editor_build.yml"
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/enforce-formatting.yml

@@ -19,6 +19,9 @@ on:
     branches: [main]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   enforce-formatting:
     runs-on: ubuntu-latest

.github/workflows/flutter_packages_test.yaml

@@ -31,6 +31,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   matrix:
     runs-on: ubuntu-latest

.github/workflows/inspector_build.yml

@@ -29,6 +29,9 @@ on:
       - "renderers/web_core/**"
       - ".github/workflows/inspector_build.yml"
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/kotlin_agent_sdk_build_and_test.yml

@@ -28,6 +28,9 @@ on:
       - "specification/**/json/**"
       - "agent_sdks/conformance/**"
 
+permissions:
+  contents: read
+
 jobs:
   build-and-test:
     runs-on: ubuntu-latest

.github/workflows/lit_build_and_test.yml

@@ -27,6 +27,9 @@ on:
       - "renderers/web_core/**"
       - ".github/workflows/lit_build_and_test.yml"
 
+permissions:
+  contents: read
+
 jobs:
   build-and-test:
     runs-on: ubuntu-latest