From de5edca29c61b15cfbf6348c793ae0df34d50983 Mon Sep 17 00:00:00 2001
From: sfan5 <sfan5@live.de>
Date: Mon, 18 May 2026 15:44:17 +0200
Subject: [PATCH] ci: clarify that cleanup_caches and comment don't use token
 permissions

---
 .github/workflows/cleanup_caches.yml | 2 ++
 .github/workflows/comment.yml        | 2 ++
 .github/workflows/fuzz.yml           | 4 ++++
 3 files changed, 8 insertions(+)

diff --git a/.github/workflows/cleanup_caches.yml b/.github/workflows/cleanup_caches.yml
index 9a152727a5..a2039aabb8 100644
--- a/.github/workflows/cleanup_caches.yml
+++ b/.github/workflows/cleanup_caches.yml
@@ -9,6 +9,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
+permissions: {} # uses own token below
+
 jobs:
   cache:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/comment.yml b/.github/workflows/comment.yml
index 0e3e78c4e0..828d4e9443 100644
--- a/.github/workflows/comment.yml
+++ b/.github/workflows/comment.yml
@@ -9,6 +9,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
+permissions: {} # uses own token below
+
 jobs:
   pr_comment:
     if: github.event.workflow_run.event == 'pull_request' &&
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index d3c71fc1c5..76fa590537 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -1,4 +1,5 @@
 name: Pull Request Fuzzing
+
 on:
   pull_request:
     branches: [master]
@@ -12,10 +13,13 @@ on:
         - 'Copyright'
         - 'README.md'
         - 'RELEASE_NOTES'
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
+
 permissions: {}
+
 jobs:
   Fuzzing:
     runs-on: ubuntu-latest