From ee47a2185173bfd0aaa17f2670ad23f54bb08eb4 Mon Sep 17 00:00:00 2001
From: jesusph04 <jesus.pertinez@wazuh.com>
Date: Mon, 3 Aug 2026 14:17:17 +0200
Subject: [PATCH] Add explicit permissions to 4.x workflows

---
 .github/workflows/4_build_and_push_images.yml | 4 ++++
 .github/workflows/4_pr_check.yml              | 3 +++
 CHANGELOG.md                                  | 2 +-
 3 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/4_build_and_push_images.yml b/.github/workflows/4_build_and_push_images.yml
index e60a00f7..6eea071c 100644
--- a/.github/workflows/4_build_and_push_images.yml
+++ b/.github/workflows/4_build_and_push_images.yml
@@ -213,6 +213,10 @@ jobs:
 
   notify:
     runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
+    
+    permissions:
+      contents: read
+      
     needs: [setup, build-and-push]
     # Only run if NOT dev AND all products were selected
     if: ${{ inputs.dev == false && needs.setup.outputs.ALL_PRODUCTS_SELECTED == 'true' }}
diff --git a/.github/workflows/4_pr_check.yml b/.github/workflows/4_pr_check.yml
index e5a11083..467953c1 100644
--- a/.github/workflows/4_pr_check.yml
+++ b/.github/workflows/4_pr_check.yml
@@ -12,6 +12,9 @@ on:
       - 'wazuh-agent/**'
       - '.github/**'
 
+permissions:
+  contents: read
+  
 env:
   ARTIFACTS_LOCAL_DIR: /home/runner/work/wazuh-docker/wazuh-docker/docker-images
   ARTIFACT_NAMES: |
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1ce00aa0..7068b4e1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,7 +9,7 @@
 
 | Issue | Comment |
 | - | - |
-
+- Added explicit `permissions` blocks to the 4.x workflows to restrict the `GITHUB_TOKEN` scope ([#2461](https://github.com/wazuh/wazuh-docker/issues/2461))
 ### Removed
 
 | Issue | Comment |