From fa2012d1a4e583a3eb1b185afee3a664390fe620 Mon Sep 17 00:00:00 2001
From: "moviepilot-codex[bot]" <moviepilot-codex[bot]@users.noreply.github.com>
Date: Mon, 21 Sep 2026 02:37:01 +0800
Subject: [PATCH] security: scope shadow workflow permissions

---
 .github/workflows/moviepilot-codex-run.yml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/moviepilot-codex-run.yml b/.github/workflows/moviepilot-codex-run.yml
index bb194e9d3..8b10ce29c 100644
--- a/.github/workflows/moviepilot-codex-run.yml
+++ b/.github/workflows/moviepilot-codex-run.yml
@@ -28,12 +28,16 @@ on:
 
 permissions:
   contents: read
-  issues: write
+  issues: read
   pull-requests: read
 
 jobs:
   shadow:
     if: ${{ vars.CODEX_ENABLED == 'true' && vars.CODEX_PUBLISH_COMMENTS != 'true' }}
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
     uses: jxxghp/MoviePilot-Maintenance/.github/workflows/codex-event.yml@main
     with:
       control_repository: jxxghp/MoviePilot-Maintenance
@@ -56,6 +60,10 @@ jobs:
 
   propose:
     if: ${{ vars.CODEX_ENABLED == 'true' && vars.CODEX_PUBLISH_COMMENTS == 'true' }}
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: read
     uses: jxxghp/MoviePilot-Maintenance/.github/workflows/codex-propose.yml@main
     with:
       control_repository: jxxghp/MoviePilot-Maintenance