From abf159911ff2ae6f9d656e930c3b741c9e96d691 Mon Sep 17 00:00:00 2001
From: Yujong Lee <yujong@berri.ai>
Date: Sat, 5 Sep 2026 17:24:05 -0700
Subject: [PATCH] fix(ci): scope CodSpeed OIDC permissions to each job

---
 .github/workflows/codspeed.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/codspeed.yml b/.github/workflows/codspeed.yml
index dd76609e26e..5e0d7c88531 100644
--- a/.github/workflows/codspeed.yml
+++ b/.github/workflows/codspeed.yml
@@ -35,7 +35,6 @@ on:
 
 permissions:
   contents: read
-  id-token: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -43,6 +42,9 @@ concurrency:
 
 jobs:
   benchmarks:
+    permissions:
+      contents: read
+      id-token: write
     runs-on: ubuntu-24.04
     timeout-minutes: 60
 
@@ -98,6 +100,9 @@ jobs:
             --codspeed
 
   e2e-walltime:
+    permissions:
+      contents: read
+      id-token: write
     runs-on: codspeed-macro
     timeout-minutes: 30