From e14b8d385a39075973e127bb0f68190dc9ee8fbb Mon Sep 17 00:00:00 2001
From: Austin Lane <vidplace7@gmail.com>
Date: Mon, 23 Mar 2026 18:54:55 -0400
Subject: [PATCH] Remove unneeded GH perms

Reduce perms to least-necessary
Remove merge_queue.yml since it's never been used and is now stale
Remove comment-artifact, it hasn't worked in ages.
---
 .github/workflows/build_debian_src.yml |   3 +-
 .github/workflows/build_one_target.yml |   2 +-
 .github/workflows/daily_packaging.yml  |   2 +-
 .github/workflows/docker_build.yml     |   2 +-
 .github/workflows/docker_manifest.yml  |   2 +-
 .github/workflows/hook_copr.yml        |   3 +-
 .github/workflows/main_matrix.yml      |  23 +-
 .github/workflows/merge_queue.yml      | 371 -------------------------
 .github/workflows/package_obs.yml      |   3 +-
 .github/workflows/package_pio_deps.yml |   3 +-
 .github/workflows/package_ppa.yml      |   3 +-
 .github/workflows/update_protobufs.yml |   2 +-
 12 files changed, 23 insertions(+), 396 deletions(-)
 delete mode 100644 .github/workflows/merge_queue.yml

diff --git a/.github/workflows/build_debian_src.yml b/.github/workflows/build_debian_src.yml
index 381806b6c..d1bcd8898 100644
--- a/.github/workflows/build_debian_src.yml
+++ b/.github/workflows/build_debian_src.yml
@@ -16,8 +16,7 @@ on:
         type: string
 
 permissions:
-  contents: write
-  packages: write
+  contents: read
 
 jobs:
   build-debian-src:
diff --git a/.github/workflows/build_one_target.yml b/.github/workflows/build_one_target.yml
index 0a1744edb..706b9cfe7 100644
--- a/.github/workflows/build_one_target.yml
+++ b/.github/workflows/build_one_target.yml
@@ -87,7 +87,7 @@ jobs:
 
   gather-artifacts:
     permissions:
-      contents: write
+      contents: read
       pull-requests: write
     runs-on: ubuntu-latest
     needs: [version, build]
diff --git a/.github/workflows/daily_packaging.yml b/.github/workflows/daily_packaging.yml
index a7d2468e1..16363f562 100644
--- a/.github/workflows/daily_packaging.yml
+++ b/.github/workflows/daily_packaging.yml
@@ -16,7 +16,7 @@ on:
       - .github/workflows/hook_copr.yml
 
 permissions:
-  contents: write
+  contents: read
   packages: write
 
 jobs:
diff --git a/.github/workflows/docker_build.yml b/.github/workflows/docker_build.yml
index 54c353b80..72987c01e 100644
--- a/.github/workflows/docker_build.yml
+++ b/.github/workflows/docker_build.yml
@@ -37,7 +37,7 @@ on:
         value: ${{ jobs.docker-build.outputs.digest }}
 
 permissions:
-  contents: write
+  contents: read
   packages: write
 
 jobs:
diff --git a/.github/workflows/docker_manifest.yml b/.github/workflows/docker_manifest.yml
index eeaacd7bd..b2fd12599 100644
--- a/.github/workflows/docker_manifest.yml
+++ b/.github/workflows/docker_manifest.yml
@@ -12,7 +12,7 @@ on:
         type: string
 
 permissions:
-  contents: write
+  contents: read
   packages: write
 
 jobs:
diff --git a/.github/workflows/hook_copr.yml b/.github/workflows/hook_copr.yml
index c51c05543..c419848a8 100644
--- a/.github/workflows/hook_copr.yml
+++ b/.github/workflows/hook_copr.yml
@@ -11,8 +11,7 @@ on:
         type: string
 
 permissions:
-  contents: write
-  packages: write
+  contents: read
 
 jobs:
   build-copr-hook:
diff --git a/.github/workflows/main_matrix.yml b/.github/workflows/main_matrix.yml
index 7467bf808..1221c171f 100644
--- a/.github/workflows/main_matrix.yml
+++ b/.github/workflows/main_matrix.yml
@@ -28,6 +28,8 @@ on:
 
   workflow_dispatch:
 
+permissions: read-all
+
 jobs:
   setup:
     strategy:
@@ -123,9 +125,16 @@ jobs:
 
   test-native:
     if: ${{ !contains(github.ref_name, 'event/') && github.repository == 'meshtastic/firmware' }}
+    permissions: # Needed for dorny/test-reporter.
+      contents: read
+      actions: read
+      checks: write
     uses: ./.github/workflows/test_native.yml
 
   docker:
+    permissions: # Needed for pushing to GHCR.
+      contents: read
+      packages: write
     strategy:
       fail-fast: false
       matrix:
@@ -150,9 +159,6 @@ jobs:
   gather-artifacts:
     # trunk-ignore(checkov/CKV2_GHA_1)
     if: github.repository == 'meshtastic/firmware'
-    permissions:
-      contents: write
-      pull-requests: write
     strategy:
       fail-fast: false
       matrix:
@@ -225,13 +231,6 @@ jobs:
           path: ./*.elf
           retention-days: 30
 
-      - uses: scruplelesswizard/comment-artifact@main
-        if: ${{ github.event_name == 'pull_request' }}
-        with:
-          name: firmware-${{matrix.arch}}-${{ needs.version.outputs.long }}
-          description: "Download firmware-${{matrix.arch}}-${{ needs.version.outputs.long }}.zip. This artifact will be available for 90 days from creation"
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-
   shame:
     if: github.repository == 'meshtastic/firmware'
     continue-on-error: true
@@ -275,6 +274,8 @@ jobs:
       #   run: python3 bin/shame.py ${{ github.event.pull_request.number }} manifests-old/ manifests-new/
 
   release-artifacts:
+    permissions: # Needed for 'gh release upload'.
+      contents: write
     runs-on: ubuntu-latest
     if: ${{ github.event_name == 'workflow_dispatch' && github.repository == 'meshtastic/firmware' }}
     outputs:
@@ -366,6 +367,8 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   release-firmware:
+    permissions: # Needed for 'gh release upload'.
+      contents: write
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/merge_queue.yml b/.github/workflows/merge_queue.yml
deleted file mode 100644
index ad8534984..000000000
--- a/.github/workflows/merge_queue.yml
+++ /dev/null
@@ -1,371 +0,0 @@
-name: Merge Queue
-# Not sure how concurrency works in merge_queue, removing for now.
-# concurrency:
-#   group: merge-queue-${{ github.head_ref || github.run_id }}
-#   cancel-in-progress: true
-on:
-  # Merge group is a special trigger that is used to trigger the workflow when a merge group is created.
-  merge_group:
-
-jobs:
-  setup:
-    strategy:
-      fail-fast: true
-      matrix:
-        arch:
-          - all
-          - check
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
-        with:
-          python-version: 3.x
-          cache: pip
-      - run: pip install -U platformio
-      - name: Generate matrix
-        id: jsonStep
-        run: |
-          if [[ "$GITHUB_HEAD_REF" == "" ]]; then
-            TARGETS=$(./bin/generate_ci_matrix.py ${{matrix.arch}})
-          else  
-            TARGETS=$(./bin/generate_ci_matrix.py ${{matrix.arch}} --level pr)
-          fi
-          echo "Name: $GITHUB_REF_NAME Base: $GITHUB_BASE_REF Ref: $GITHUB_REF"
-          echo "${{matrix.arch}}=$TARGETS" >> $GITHUB_OUTPUT
-    outputs:
-      all: ${{ steps.jsonStep.outputs.all }}
-      check: ${{ steps.jsonStep.outputs.check }}
-
-  version:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - name: Get release version string
-        run: |
-          echo "long=$(./bin/buildinfo.py long)" >> $GITHUB_OUTPUT
-          echo "deb=$(./bin/buildinfo.py deb)" >> $GITHUB_OUTPUT
-        id: version
-        env:
-          BUILD_LOCATION: local
-    outputs:
-      long: ${{ steps.version.outputs.long }}
-      deb: ${{ steps.version.outputs.deb }}
-
-  check:
-    needs: setup
-    strategy:
-      fail-fast: true
-      matrix:
-        check: ${{ fromJson(needs.setup.outputs.check) }}
-
-    runs-on: ubuntu-latest
-    if: ${{ github.event_name != 'workflow_dispatch' }}
-    steps:
-      - uses: actions/checkout@v6
-      - name: Build base
-        id: base
-        uses: ./.github/actions/setup-base
-      - name: Check ${{ matrix.check.board }}
-        run: bin/check-all.sh ${{ matrix.check.board }}
-
-  build:
-    needs: [setup, version]
-    strategy:
-      matrix:
-        build: ${{ fromJson(needs.setup.outputs.all) }}
-    uses: ./.github/workflows/build_firmware.yml
-    with:
-      version: ${{ needs.version.outputs.long }}
-      pio_env: ${{ matrix.build.board }}
-      platform: ${{ matrix.build.platform }}
-
-  build-debian-src:
-    if: github.repository == 'meshtastic/firmware'
-    uses: ./.github/workflows/build_debian_src.yml
-    with:
-      series: UNRELEASED
-      build_location: local
-    secrets: inherit
-
-  package-pio-deps-native-tft:
-    if: ${{ github.event_name == 'workflow_dispatch' }}
-    uses: ./.github/workflows/package_pio_deps.yml
-    with:
-      pio_env: native-tft
-    secrets: inherit
-
-  test-native:
-    if: ${{ !contains(github.ref_name, 'event/') }}
-    uses: ./.github/workflows/test_native.yml
-
-  docker:
-    strategy:
-      fail-fast: false
-      matrix:
-        distro: [debian, alpine]
-        platform: [linux/amd64, linux/arm64, linux/arm/v7]
-        pio_env: [native, native-tft]
-        exclude:
-          - distro: alpine
-            platform: linux/arm/v7
-          - pio_env: native-tft
-            platform: linux/arm64
-          - pio_env: native-tft
-            platform: linux/arm/v7
-    uses: ./.github/workflows/docker_build.yml
-    with:
-      distro: ${{ matrix.distro }}
-      platform: ${{ matrix.platform }}
-      runs-on: ${{ contains(matrix.platform, 'arm') && 'ubuntu-24.04-arm' || 'ubuntu-24.04' }}
-      pio_env: ${{ matrix.pio_env }}
-      push: false
-
-  gather-artifacts:
-    # trunk-ignore(checkov/CKV2_GHA_1)
-    permissions:
-      contents: write
-      pull-requests: write
-    strategy:
-      fail-fast: false
-      matrix:
-        arch:
-          - esp32
-          - esp32s3
-          - esp32c3
-          - esp32c6
-          - nrf52840
-          - rp2040
-          - rp2350
-          - stm32
-    runs-on: ubuntu-latest
-    needs: [version, build]
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-        with:
-          ref: ${{github.event.pull_request.head.ref}}
-          repository: ${{github.event.pull_request.head.repo.full_name}}
-
-      - uses: actions/download-artifact@v8
-        with:
-          path: ./
-          pattern: firmware-${{matrix.arch}}-*
-          merge-multiple: true
-
-      - name: Display structure of downloaded files
-        run: ls -R
-
-      - name: Move files up
-        run: mv -b -t ./ ./bin/device-*.sh ./bin/device-*.bat
-
-      - name: Repackage in single firmware zip
-        uses: actions/upload-artifact@v7
-        with:
-          name: firmware-${{matrix.arch}}-${{ needs.version.outputs.long }}
-          overwrite: true
-          path: |
-            ./firmware-*.bin
-            ./firmware-*.uf2
-            ./firmware-*.hex
-            ./firmware-*.zip
-            ./device-*.sh
-            ./device-*.bat
-            ./littlefs-*.bin
-            ./bleota*bin
-            ./Meshtastic_nRF52_factory_erase*.uf2
-          retention-days: 30
-
-      - uses: actions/download-artifact@v8
-        with:
-          name: firmware-${{matrix.arch}}-${{ needs.version.outputs.long }}
-          merge-multiple: true
-          path: ./output
-
-      # For diagnostics
-      - name: Show artifacts
-        run: ls -lR
-
-      - name: Device scripts permissions
-        run: |
-          chmod +x ./output/device-install.sh || true
-          chmod +x ./output/device-update.sh || true
-
-      - name: Zip firmware
-        run: zip -j -9 -r ./firmware-${{matrix.arch}}-${{ needs.version.outputs.long }}.zip ./output
-
-      - name: Repackage in single elfs zip
-        uses: actions/upload-artifact@v7
-        with:
-          name: debug-elfs-${{matrix.arch}}-${{ needs.version.outputs.long }}
-          overwrite: true
-          path: ./*.elf
-          retention-days: 30
-
-      - uses: scruplelesswizard/comment-artifact@main
-        if: ${{ github.event_name == 'pull_request' }}
-        with:
-          name: firmware-${{matrix.arch}}-${{ needs.version.outputs.long }}
-          description: "Download firmware-${{matrix.arch}}-${{ needs.version.outputs.long }}.zip. This artifact will be available for 90 days from creation"
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-
-  release-artifacts:
-    runs-on: ubuntu-latest
-    if: ${{ github.event_name == 'workflow_dispatch' }}
-    outputs:
-      upload_url: ${{ steps.create_release.outputs.upload_url }}
-    needs:
-      - version
-      - gather-artifacts
-      - build-debian-src
-      - package-pio-deps-native-tft
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Create release
-        uses: softprops/action-gh-release@v2
-        id: create_release
-        with:
-          draft: true
-          prerelease: true
-          name: Meshtastic Firmware ${{ needs.version.outputs.long }} Alpha
-          tag_name: v${{ needs.version.outputs.long }}
-          body: |
-            Autogenerated by github action, developer should edit as required before publishing...
-
-      - name: Download source deb
-        uses: actions/download-artifact@v8
-        with:
-          pattern: firmware-debian-${{ needs.version.outputs.deb }}~UNRELEASED-src
-          merge-multiple: true
-          path: ./output/debian-src
-
-      - name: Download `native-tft` pio deps
-        uses: actions/download-artifact@v8
-        with:
-          pattern: platformio-deps-native-tft-${{ needs.version.outputs.long }}
-          merge-multiple: true
-          path: ./output/pio-deps-native-tft
-
-      - name: Zip Linux sources
-        working-directory: output
-        run: |
-          zip -j -9 -r ./meshtasticd-${{ needs.version.outputs.deb }}-src.zip ./debian-src
-          zip -9 -r ./platformio-deps-native-tft-${{ needs.version.outputs.long }}.zip ./pio-deps-native-tft
-
-      # For diagnostics
-      - name: Display structure of downloaded files
-        run: ls -lR
-
-      - name: Add Linux sources to GtiHub Release
-        # Only run when targeting master branch with workflow_dispatch
-        if: ${{ github.ref_name == 'master' }}
-        run: |
-          gh release upload v${{ needs.version.outputs.long }} ./output/meshtasticd-${{ needs.version.outputs.deb }}-src.zip
-          gh release upload v${{ needs.version.outputs.long }} ./output/platformio-deps-native-tft-${{ needs.version.outputs.long }}.zip
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-  release-firmware:
-    strategy:
-      fail-fast: false
-      matrix:
-        arch:
-          - esp32
-          - esp32s3
-          - esp32c3
-          - esp32c6
-          - nrf52840
-          - rp2040
-          - rp2350
-          - stm32
-    runs-on: ubuntu-latest
-    if: ${{ github.event_name == 'workflow_dispatch' }}
-    needs: [release-artifacts, version]
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Setup Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: 3.x
-
-      - uses: actions/download-artifact@v8
-        with:
-          pattern: firmware-${{matrix.arch}}-${{ needs.version.outputs.long }}
-          merge-multiple: true
-          path: ./output
-
-      - name: Display structure of downloaded files
-        run: ls -lR
-
-      - name: Device scripts permissions
-        run: |
-          chmod +x ./output/device-install.sh || true
-          chmod +x ./output/device-update.sh || true
-
-      - name: Zip firmware
-        run: zip -j -9 -r ./firmware-${{matrix.arch}}-${{ needs.version.outputs.long }}.zip ./output
-
-      - uses: actions/download-artifact@v8
-        with:
-          name: debug-elfs-${{matrix.arch}}-${{ needs.version.outputs.long }}
-          merge-multiple: true
-          path: ./elfs
-
-      - name: Zip debug elfs
-        run: zip -j -9 -r ./debug-elfs-${{matrix.arch}}-${{ needs.version.outputs.long }}.zip ./elfs
-
-      # For diagnostics
-      - name: Display structure of downloaded files
-        run: ls -lR
-
-      - name: Add bins and debug elfs to GitHub Release
-        # Only run when targeting master branch with workflow_dispatch
-        if: ${{ github.ref_name == 'master' }}
-        run: |
-          gh release upload v${{ needs.version.outputs.long }} ./firmware-${{matrix.arch}}-${{ needs.version.outputs.long }}.zip
-          gh release upload v${{ needs.version.outputs.long }} ./debug-elfs-${{matrix.arch}}-${{ needs.version.outputs.long }}.zip
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-  publish-firmware:
-    runs-on: ubuntu-24.04
-    if: ${{ github.event_name == 'workflow_dispatch' }}
-    needs: [release-firmware, version]
-    env:
-      targets: |-
-        esp32,esp32s3,esp32c3,esp32c6,nrf52840,rp2040,rp2350,stm32
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Setup Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: 3.x
-
-      - uses: actions/download-artifact@v8
-        with:
-          pattern: firmware-{${{ env.targets }}}-${{ needs.version.outputs.long }}
-          merge-multiple: true
-          path: ./publish
-
-      - name: Publish firmware to meshtastic.github.io
-        uses: peaceiris/actions-gh-pages@v4
-        env:
-          # On event/* branches, use the event name as the destination prefix
-          DEST_PREFIX: ${{ contains(github.ref_name, 'event/') && format('{0}/', github.ref_name) || '' }}
-        with:
-          deploy_key: ${{ secrets.DIST_PAGES_DEPLOY_KEY }}
-          external_repository: meshtastic/meshtastic.github.io
-          publish_branch: master
-          publish_dir: ./publish
-          destination_dir: ${{ env.DEST_PREFIX }}firmware-${{ needs.version.outputs.long }}
-          keep_files: true
-          user_name: github-actions[bot]
-          user_email: github-actions[bot]@users.noreply.github.com
-          commit_message: ${{ needs.version.outputs.long }}
-          enable_jekyll: true
diff --git a/.github/workflows/package_obs.yml b/.github/workflows/package_obs.yml
index 395b721a5..b491f0062 100644
--- a/.github/workflows/package_obs.yml
+++ b/.github/workflows/package_obs.yml
@@ -18,8 +18,7 @@ on:
         type: string
 
 permissions:
-  contents: write
-  packages: write
+  contents: read
 
 jobs:
   build-debian-src:
diff --git a/.github/workflows/package_pio_deps.yml b/.github/workflows/package_pio_deps.yml
index d646f74f0..6bd256f52 100644
--- a/.github/workflows/package_pio_deps.yml
+++ b/.github/workflows/package_pio_deps.yml
@@ -16,8 +16,7 @@ on:
         type: string
 
 permissions:
-  contents: write
-  packages: write
+  contents: read
 
 jobs:
   pkg-pio-libdeps:
diff --git a/.github/workflows/package_ppa.yml b/.github/workflows/package_ppa.yml
index a16bd9575..334a7016d 100644
--- a/.github/workflows/package_ppa.yml
+++ b/.github/workflows/package_ppa.yml
@@ -16,8 +16,7 @@ on:
         type: string
 
 permissions:
-  contents: write
-  packages: write
+  contents: read
 
 jobs:
   build-debian-src:
diff --git a/.github/workflows/update_protobufs.yml b/.github/workflows/update_protobufs.yml
index 35565d1e4..e9380467e 100644
--- a/.github/workflows/update_protobufs.yml
+++ b/.github/workflows/update_protobufs.yml
@@ -6,7 +6,7 @@ permissions: read-all
 jobs:
   update-protobufs:
     runs-on: ubuntu-latest
-    permissions:
+    permissions: # Needed for peter-evans/create-pull-request.
       contents: write
       pull-requests: write
     steps: