ci: declare explicit permissions on the shared workflow callers

[prisis]

These workflows call reusable workflows in anolilab/workflows and declare no permissions of their own, so the token they receive is whatever the repository default happens to be — currently write.

That default is the only thing keeping this repository from running Actions with a read-only token. A caller cannot grant a reusable workflow more than it holds, so each block below is exactly what the callee declares, read from the callee rather than guessed:

• allo-allo.yaml — contents: read, issues: write, pull-requests: write
• cache-clear.yml — actions: write, contents: read
• stale-issues.yml — contents: read, issues: write, pull-requests: write

Once this merges the repository default can drop to read-only with nothing losing access it was using.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CLftRo14oumJr2GEa8rPgf

Summary by CodeRabbit

• Chores
  • Updated automated workflows with explicit permissions for repository content, issue and pull request management, and action cache maintenance.
  • Enables workflows to label and comment on issues and pull requests and clear action caches where required.

[github-actions]

Thank you for following the naming conventions! 🙏

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 98d6c0d7-2b4d-4da7-a250-20ac471a7528

📥 Commits

Reviewing files that changed from the base of the PR and between e9f6489 and c4da8e9.

📒 Files selected for processing (3)

• .github/workflows/allo-allo.yaml
• .github/workflows/cache-clear.yml
• .github/workflows/stale-issues.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Three GitHub Actions workflows now declare explicit permissions for repository access, issue and pull request updates, and cache deletion.

Changes

Workflow permissions

Layer / File(s)	Summary
Declare workflow permissions .github/workflows/allo-allo.yaml, .github/workflows/cache-clear.yml, .github/workflows/stale-issues.yml	The workflows now grant read access to repository contents. The relevant workflows also grant write access to issues, pull requests, or Actions caches.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: ⚪ Minimal · up to c4da8

The workflows retain the access needed to manage issues, pull requests, and caches while supporting read-only default token permissions. No current merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: adding explicit permissions to shared workflow callers.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/explicit-workflow-permissions

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}