From 23a9cfe8cf371885e4b6484d2f7ab486612e1854 Mon Sep 17 00:00:00 2001
From: necusjz <necusjz@gmail.com>
Date: Mon, 1 Jun 2026 11:17:18 +1000
Subject: [PATCH] ci: tighten permission

---
 .github/workflows/AddPRComment.yml  |  2 +-
 .github/workflows/AzdevLinter.yml   |  2 +-
 .github/workflows/AzdevStyle.yml    |  2 +-
 .github/workflows/BlockPRMerge.yml  |  5 ++++-
 .github/workflows/CCOA.yml          |  8 +++++---
 .github/workflows/GitHookNotice.yml | 16 +++++++---------
 6 files changed, 19 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/AddPRComment.yml b/.github/workflows/AddPRComment.yml
index 2e242353c25..684517e657f 100644
--- a/.github/workflows/AddPRComment.yml
+++ b/.github/workflows/AddPRComment.yml
@@ -1,5 +1,5 @@
 on:
-  pull_request_target:
+  pull_request:
     types: [opened]
     branches:
       - dev
diff --git a/.github/workflows/AzdevLinter.yml b/.github/workflows/AzdevLinter.yml
index 372be7f0982..73983edd739 100644
--- a/.github/workflows/AzdevLinter.yml
+++ b/.github/workflows/AzdevLinter.yml
@@ -1,6 +1,6 @@
 name: GH Check CLI Linter
 on:
-  pull_request_target:
+  pull_request:
     types: [opened, labeled, unlabeled, synchronize]
     branches:
       - dev
diff --git a/.github/workflows/AzdevStyle.yml b/.github/workflows/AzdevStyle.yml
index 49affa5fd5f..c2c40115317 100644
--- a/.github/workflows/AzdevStyle.yml
+++ b/.github/workflows/AzdevStyle.yml
@@ -1,6 +1,6 @@
 name: GH Check CLI Style
 on:
-  pull_request_target:
+  pull_request:
     types: [opened, labeled, unlabeled, synchronize]
     branches:
       - dev
diff --git a/.github/workflows/BlockPRMerge.yml b/.github/workflows/BlockPRMerge.yml
index 890fb5abbe1..f108496c252 100644
--- a/.github/workflows/BlockPRMerge.yml
+++ b/.github/workflows/BlockPRMerge.yml
@@ -1,15 +1,18 @@
 name: Block PR merging on blocked labels
 
 on:
-  pull_request_target:
+  pull_request:
     types: [labeled, unlabeled]
     branches:
       - dev
       - release
 
+permissions: {}
+
 jobs:
   block-merge:
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
       - name: Check blocked labels
         uses: actions/github-script@v7
diff --git a/.github/workflows/CCOA.yml b/.github/workflows/CCOA.yml
index 980c34e35ce..79d66238343 100644
--- a/.github/workflows/CCOA.yml
+++ b/.github/workflows/CCOA.yml
@@ -1,19 +1,21 @@
 name: CCOA
 
 on:
-  pull_request_target:
+  pull_request:
     types:
       - opened
       - reopened
     branches:
       - dev
 
-permissions:
-  pull-requests: write
+permissions: {}
 
 jobs:
   add_label_and_comment:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+      issues: write
 
     steps:
       - name: Check current date securely
diff --git a/.github/workflows/GitHookNotice.yml b/.github/workflows/GitHookNotice.yml
index 7791136ef6b..1f2a569db85 100644
--- a/.github/workflows/GitHookNotice.yml
+++ b/.github/workflows/GitHookNotice.yml
@@ -1,6 +1,6 @@
 name: Git Hook Notice
 on:
-  pull_request_target:
+  pull_request:
     types: [opened]
     branches:
       - dev
@@ -11,7 +11,7 @@ jobs:
   git-hook-notice:
     runs-on: ubuntu-latest
     permissions:
-      pull-requests: write
+      contents: read
     name: Introduce git hook in developer env
     steps:
       - name: Checkout git hook notice message
@@ -19,10 +19,8 @@ jobs:
         with:
           sparse-checkout: |
             .github/template/git-hooks-note.md
-      - name: Comment on pull request
-        uses: mshick/add-pr-comment@v2
-        with:
-           repo-token: ${{ secrets.GITHUB_TOKEN }}
-           message-id: gitHookNoticeComment
-           message-path: |
-            .github/template/git-hooks-note.md 
+      - name: Show git hook notice
+        run: |
+          echo "::group::Git hook notice"
+          cat .github/template/git-hooks-note.md
+          echo "::endgroup::"