From 6ba4342909540c2b6209cdaafcb0480040316a30 Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Wed, 7 Oct 2026 12:27:50 +0100
Subject: [PATCH] Allow setting permissions for `workflowCall`

---
 .github/workflows/__pr.yml |  2 +-
 pr-checks/sync.ts          | 20 ++++++++++++--------
 2 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/__pr.yml b/.github/workflows/__pr.yml
index 6199a9b9c..fe5e4ec47 100644
--- a/.github/workflows/__pr.yml
+++ b/.github/workflows/__pr.yml
@@ -60,7 +60,7 @@ jobs:
     name: Initial checks
     permissions:
       contents: read
-      security-events: read
+      security-events: write
     uses: ./.github/workflows/pr-checks.yml
   all-platform-bundle:
     needs:
diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts
index 7a848c48e..55be2188b 100755
--- a/pr-checks/sync.ts
+++ b/pr-checks/sync.ts
@@ -709,16 +709,20 @@ function generateValidationJobs(
 function workflowCall(
   jobName: string,
   workflowBaseName: string,
-  inputs?: Record<string, string>,
+  options?: {
+    inputs?: Record<string, string>;
+    permissions?: Record<string, "read" | "write">;
+  },
 ) {
   return {
     name: jobName,
     permissions: {
       contents: "read",
       "security-events": "read",
+      ...options?.permissions,
     },
     uses: `./.github/workflows/${workflowBaseName}.yml`,
-    with: inputs,
+    with: options?.inputs,
   };
 }
 
@@ -740,7 +744,9 @@ function main(): void {
 
   let allInputs: Record<string, WorkflowInput> = {};
 
-  const initialChecksJob = workflowCall("Initial checks", "pr-checks");
+  const initialChecksJob = workflowCall("Initial checks", "pr-checks", {
+    permissions: { "security-events": "write" },
+  });
 
   const cron = new yaml.Scalar("0 5 * * *");
   cron.type = yaml.Scalar.QUOTE_SINGLE;
@@ -856,11 +862,9 @@ function main(): void {
         checkWith[inputName] = `\${{ inputs.${inputName} }}`;
       }
 
-      jobs[checkName] = workflowCall(
-        specification.name,
-        `__${checkName}`,
-        checkWith,
-      );
+      jobs[checkName] = workflowCall(specification.name, `__${checkName}`, {
+        inputs: checkWith,
+      });
     }
 
     const collectionWorkflow = {