diff --git a/.github/workflows/ab-testing-advisor.lock.yml b/.github/workflows/ab-testing-advisor.lock.yml
index 305b7858549..17e8c0e5209 100644
--- a/.github/workflows/ab-testing-advisor.lock.yml
+++ b/.github/workflows/ab-testing-advisor.lock.yml
@@ -1052,7 +1052,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-ab-testing-advisor"
@@ -1883,7 +1882,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/ace-editor.lock.yml b/.github/workflows/ace-editor.lock.yml
index 0b6b3d5026b..b4cb9cd1cba 100644
--- a/.github/workflows/ace-editor.lock.yml
+++ b/.github/workflows/ace-editor.lock.yml
@@ -996,7 +996,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-ace-editor"
@@ -1594,7 +1593,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/agent-performance-analyzer.lock.yml b/.github/workflows/agent-performance-analyzer.lock.yml
index 76ff3d519b1..2133a42d0cb 100644
--- a/.github/workflows/agent-performance-analyzer.lock.yml
+++ b/.github/workflows/agent-performance-analyzer.lock.yml
@@ -1262,7 +1262,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
       pull-requests: write
@@ -2246,7 +2245,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
       pull-requests: write
diff --git a/.github/workflows/agent-persona-explorer.lock.yml b/.github/workflows/agent-persona-explorer.lock.yml
index 14635334861..725e7ac00f2 100644
--- a/.github/workflows/agent-persona-explorer.lock.yml
+++ b/.github/workflows/agent-persona-explorer.lock.yml
@@ -1176,7 +1176,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-agent-persona-explorer"
@@ -2028,7 +2027,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/agentic-token-audit.lock.yml b/.github/workflows/agentic-token-audit.lock.yml
index 452669f896a..174c56f11fb 100644
--- a/.github/workflows/agentic-token-audit.lock.yml
+++ b/.github/workflows/agentic-token-audit.lock.yml
@@ -1184,7 +1184,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-agentic-token-audit"
@@ -2111,7 +2110,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/agentic-token-optimizer.lock.yml b/.github/workflows/agentic-token-optimizer.lock.yml
index 02bac81a411..fedc7e49662 100644
--- a/.github/workflows/agentic-token-optimizer.lock.yml
+++ b/.github/workflows/agentic-token-optimizer.lock.yml
@@ -1058,7 +1058,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-agentic-token-optimizer"
@@ -1706,7 +1705,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/agentic-token-trend-audit.lock.yml b/.github/workflows/agentic-token-trend-audit.lock.yml
index bc9520b199e..4be44920a56 100644
--- a/.github/workflows/agentic-token-trend-audit.lock.yml
+++ b/.github/workflows/agentic-token-trend-audit.lock.yml
@@ -1144,7 +1144,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-agentic-token-trend-audit"
@@ -1937,7 +1936,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/ai-moderator.lock.yml b/.github/workflows/ai-moderator.lock.yml
index 16406742d17..18d2e00bfa1 100644
--- a/.github/workflows/ai-moderator.lock.yml
+++ b/.github/workflows/ai-moderator.lock.yml
@@ -1162,7 +1162,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
       pull-requests: write
@@ -1847,7 +1846,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
       pull-requests: write
diff --git a/.github/workflows/api-consumption-report.lock.yml b/.github/workflows/api-consumption-report.lock.yml
index d010a3abde1..94e778f2d36 100644
--- a/.github/workflows/api-consumption-report.lock.yml
+++ b/.github/workflows/api-consumption-report.lock.yml
@@ -1521,7 +1521,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -2325,7 +2324,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/approach-validator.lock.yml b/.github/workflows/approach-validator.lock.yml
index 8cdf693b691..5f4c586b364 100644
--- a/.github/workflows/approach-validator.lock.yml
+++ b/.github/workflows/approach-validator.lock.yml
@@ -1229,7 +1229,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -2109,7 +2108,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/archie.lock.yml b/.github/workflows/archie.lock.yml
index f24f5146067..5e85d557f17 100644
--- a/.github/workflows/archie.lock.yml
+++ b/.github/workflows/archie.lock.yml
@@ -1120,7 +1120,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -1990,7 +1989,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/architecture-guardian.lock.yml b/.github/workflows/architecture-guardian.lock.yml
index fd3feb53373..10cd49cc51d 100644
--- a/.github/workflows/architecture-guardian.lock.yml
+++ b/.github/workflows/architecture-guardian.lock.yml
@@ -1122,7 +1122,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-architecture-guardian"
@@ -2070,7 +2069,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/artifacts-summary.lock.yml b/.github/workflows/artifacts-summary.lock.yml
index 6d2400eb342..99203b63386 100644
--- a/.github/workflows/artifacts-summary.lock.yml
+++ b/.github/workflows/artifacts-summary.lock.yml
@@ -1032,7 +1032,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1831,7 +1830,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/audit-workflows.lock.yml b/.github/workflows/audit-workflows.lock.yml
index e14d00942f3..07ca65ccb2a 100644
--- a/.github/workflows/audit-workflows.lock.yml
+++ b/.github/workflows/audit-workflows.lock.yml
@@ -1361,7 +1361,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -2350,7 +2349,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/auto-triage-issues.lock.yml b/.github/workflows/auto-triage-issues.lock.yml
index d5a1422428c..7901620a31f 100644
--- a/.github/workflows/auto-triage-issues.lock.yml
+++ b/.github/workflows/auto-triage-issues.lock.yml
@@ -1084,7 +1084,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
       pull-requests: write
@@ -1914,7 +1913,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
       pull-requests: write
diff --git a/.github/workflows/aw-failure-investigator.lock.yml b/.github/workflows/aw-failure-investigator.lock.yml
index 065e8d6f6dd..26a33c66107 100644
--- a/.github/workflows/aw-failure-investigator.lock.yml
+++ b/.github/workflows/aw-failure-investigator.lock.yml
@@ -1314,7 +1314,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-aw-failure-investigator"
@@ -2199,7 +2198,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/blog-auditor.lock.yml b/.github/workflows/blog-auditor.lock.yml
index c749b478a53..d96e14d5362 100644
--- a/.github/workflows/blog-auditor.lock.yml
+++ b/.github/workflows/blog-auditor.lock.yml
@@ -1190,7 +1190,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -2078,7 +2077,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/bot-detection.lock.yml b/.github/workflows/bot-detection.lock.yml
index f6e4a0d53ab..b8bd6327d8e 100644
--- a/.github/workflows/bot-detection.lock.yml
+++ b/.github/workflows/bot-detection.lock.yml
@@ -1112,7 +1112,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-bot-detection"
@@ -2464,7 +2463,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/breaking-change-checker.lock.yml b/.github/workflows/breaking-change-checker.lock.yml
index 45c5235acef..789e74ccefd 100644
--- a/.github/workflows/breaking-change-checker.lock.yml
+++ b/.github/workflows/breaking-change-checker.lock.yml
@@ -1117,7 +1117,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-breaking-change-checker"
@@ -2065,7 +2064,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/ci-doctor.lock.yml b/.github/workflows/ci-doctor.lock.yml
index 6cf490326e0..72efe80a38c 100644
--- a/.github/workflows/ci-doctor.lock.yml
+++ b/.github/workflows/ci-doctor.lock.yml
@@ -1331,7 +1331,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -2210,7 +2209,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/claude-code-user-docs-review.lock.yml b/.github/workflows/claude-code-user-docs-review.lock.yml
index cd83f06ff7c..089be4903e8 100644
--- a/.github/workflows/claude-code-user-docs-review.lock.yml
+++ b/.github/workflows/claude-code-user-docs-review.lock.yml
@@ -1158,7 +1158,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1964,7 +1963,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/cli-consistency-checker.lock.yml b/.github/workflows/cli-consistency-checker.lock.yml
index aa09392f20b..01d9de29b9d 100644
--- a/.github/workflows/cli-consistency-checker.lock.yml
+++ b/.github/workflows/cli-consistency-checker.lock.yml
@@ -1047,7 +1047,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-cli-consistency-checker"
@@ -1843,7 +1842,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/cli-version-checker.lock.yml b/.github/workflows/cli-version-checker.lock.yml
index c73834b68bd..6d84fb9cb0f 100644
--- a/.github/workflows/cli-version-checker.lock.yml
+++ b/.github/workflows/cli-version-checker.lock.yml
@@ -1152,7 +1152,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-cli-version-checker"
@@ -1948,7 +1947,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/codex-github-remote-mcp-test.lock.yml b/.github/workflows/codex-github-remote-mcp-test.lock.yml
index 7139f6d950f..4e5403c81ad 100644
--- a/.github/workflows/codex-github-remote-mcp-test.lock.yml
+++ b/.github/workflows/codex-github-remote-mcp-test.lock.yml
@@ -995,7 +995,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-codex-github-remote-mcp-test"
@@ -1186,7 +1185,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/commit-changes-analyzer.lock.yml b/.github/workflows/commit-changes-analyzer.lock.yml
index ca0cfd3eac2..10ae1b9c846 100644
--- a/.github/workflows/commit-changes-analyzer.lock.yml
+++ b/.github/workflows/commit-changes-analyzer.lock.yml
@@ -1001,7 +1001,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1766,7 +1765,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/constraint-solving-potd.lock.yml b/.github/workflows/constraint-solving-potd.lock.yml
index 8a3b18ef5b5..36efccbe381 100644
--- a/.github/workflows/constraint-solving-potd.lock.yml
+++ b/.github/workflows/constraint-solving-potd.lock.yml
@@ -1051,7 +1051,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1844,7 +1843,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/contribution-check.lock.yml b/.github/workflows/contribution-check.lock.yml
index 09aa3519ac6..d89f530bc33 100644
--- a/.github/workflows/contribution-check.lock.yml
+++ b/.github/workflows/contribution-check.lock.yml
@@ -1187,7 +1187,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -1976,7 +1975,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/copilot-agent-analysis.lock.yml b/.github/workflows/copilot-agent-analysis.lock.yml
index ea29f0ca03d..5d845fd3273 100644
--- a/.github/workflows/copilot-agent-analysis.lock.yml
+++ b/.github/workflows/copilot-agent-analysis.lock.yml
@@ -1233,7 +1233,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -2217,7 +2216,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/copilot-centralization-drilldown.lock.yml b/.github/workflows/copilot-centralization-drilldown.lock.yml
index 536733b08a1..5b6af43b755 100644
--- a/.github/workflows/copilot-centralization-drilldown.lock.yml
+++ b/.github/workflows/copilot-centralization-drilldown.lock.yml
@@ -1017,7 +1017,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-copilot-centralization-drilldown"
@@ -1837,7 +1836,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/copilot-centralization-optimizer.lock.yml b/.github/workflows/copilot-centralization-optimizer.lock.yml
index 1181db85ff7..922f04fd816 100644
--- a/.github/workflows/copilot-centralization-optimizer.lock.yml
+++ b/.github/workflows/copilot-centralization-optimizer.lock.yml
@@ -1063,7 +1063,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-copilot-centralization-optimizer"
@@ -1981,7 +1980,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/copilot-cli-deep-research.lock.yml b/.github/workflows/copilot-cli-deep-research.lock.yml
index f71c30ed966..2554c94c294 100644
--- a/.github/workflows/copilot-cli-deep-research.lock.yml
+++ b/.github/workflows/copilot-cli-deep-research.lock.yml
@@ -1085,7 +1085,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-copilot-cli-deep-research"
@@ -1979,7 +1978,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/copilot-opt.lock.yml b/.github/workflows/copilot-opt.lock.yml
index 97a1ba91c33..8d24500ff6f 100644
--- a/.github/workflows/copilot-opt.lock.yml
+++ b/.github/workflows/copilot-opt.lock.yml
@@ -1149,7 +1149,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-copilot-opt"
@@ -1946,7 +1945,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/copilot-pr-merged-report.lock.yml b/.github/workflows/copilot-pr-merged-report.lock.yml
index ad8c1bc94a4..82d0f338661 100644
--- a/.github/workflows/copilot-pr-merged-report.lock.yml
+++ b/.github/workflows/copilot-pr-merged-report.lock.yml
@@ -1007,7 +1007,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1809,7 +1808,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/copilot-pr-nlp-analysis.lock.yml b/.github/workflows/copilot-pr-nlp-analysis.lock.yml
index ab2be783608..0bb8a41a24e 100644
--- a/.github/workflows/copilot-pr-nlp-analysis.lock.yml
+++ b/.github/workflows/copilot-pr-nlp-analysis.lock.yml
@@ -1193,7 +1193,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -2093,7 +2092,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/copilot-pr-prompt-analysis.lock.yml b/.github/workflows/copilot-pr-prompt-analysis.lock.yml
index 21efd564f51..e25805b7f98 100644
--- a/.github/workflows/copilot-pr-prompt-analysis.lock.yml
+++ b/.github/workflows/copilot-pr-prompt-analysis.lock.yml
@@ -1132,7 +1132,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -2032,7 +2031,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/copilot-session-insights.lock.yml b/.github/workflows/copilot-session-insights.lock.yml
index f531b2fd8fd..4b3acc10419 100644
--- a/.github/workflows/copilot-session-insights.lock.yml
+++ b/.github/workflows/copilot-session-insights.lock.yml
@@ -1254,7 +1254,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -2151,7 +2150,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/daily-agentrx-trace-optimizer.lock.yml b/.github/workflows/daily-agentrx-trace-optimizer.lock.yml
index b27289aa54e..f2745e18cc5 100644
--- a/.github/workflows/daily-agentrx-trace-optimizer.lock.yml
+++ b/.github/workflows/daily-agentrx-trace-optimizer.lock.yml
@@ -1254,7 +1254,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -2142,7 +2141,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/daily-ambient-context-optimizer.lock.yml b/.github/workflows/daily-ambient-context-optimizer.lock.yml
index ed64a5881d6..bcec36addd0 100644
--- a/.github/workflows/daily-ambient-context-optimizer.lock.yml
+++ b/.github/workflows/daily-ambient-context-optimizer.lock.yml
@@ -1177,7 +1177,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-daily-ambient-context-optimizer"
@@ -1980,7 +1979,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/daily-assign-issue-to-user.lock.yml b/.github/workflows/daily-assign-issue-to-user.lock.yml
index e35a2734649..ab6f2f404c6 100644
--- a/.github/workflows/daily-assign-issue-to-user.lock.yml
+++ b/.github/workflows/daily-assign-issue-to-user.lock.yml
@@ -1062,7 +1062,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -1859,7 +1858,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/daily-aw-cross-repo-compile-check.lock.yml b/.github/workflows/daily-aw-cross-repo-compile-check.lock.yml
index b8ba3a6007b..e5224450c69 100644
--- a/.github/workflows/daily-aw-cross-repo-compile-check.lock.yml
+++ b/.github/workflows/daily-aw-cross-repo-compile-check.lock.yml
@@ -1150,7 +1150,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-daily-aw-cross-repo-compile-check"
@@ -1952,7 +1951,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/daily-awf-spec-compiler-surfacing.lock.yml b/.github/workflows/daily-awf-spec-compiler-surfacing.lock.yml
index 36d62680339..3542b45fe85 100644
--- a/.github/workflows/daily-awf-spec-compiler-surfacing.lock.yml
+++ b/.github/workflows/daily-awf-spec-compiler-surfacing.lock.yml
@@ -1042,7 +1042,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-daily-awf-spec-compiler-surfacing"
@@ -1625,7 +1624,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/daily-byok-ollama-test.lock.yml b/.github/workflows/daily-byok-ollama-test.lock.yml
index 003c7eb084b..8750607cebd 100644
--- a/.github/workflows/daily-byok-ollama-test.lock.yml
+++ b/.github/workflows/daily-byok-ollama-test.lock.yml
@@ -1047,7 +1047,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-daily-byok-ollama-test"
@@ -1536,7 +1535,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/daily-cache-strategy-analyzer.lock.yml b/.github/workflows/daily-cache-strategy-analyzer.lock.yml
index 32820d4f04d..3bee02103a3 100644
--- a/.github/workflows/daily-cache-strategy-analyzer.lock.yml
+++ b/.github/workflows/daily-cache-strategy-analyzer.lock.yml
@@ -1292,7 +1292,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -2253,7 +2252,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/daily-cli-performance.lock.yml b/.github/workflows/daily-cli-performance.lock.yml
index 8798ee34d58..467a7a4288c 100644
--- a/.github/workflows/daily-cli-performance.lock.yml
+++ b/.github/workflows/daily-cli-performance.lock.yml
@@ -1328,7 +1328,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
       pull-requests: write
@@ -2309,7 +2308,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
       pull-requests: write
diff --git a/.github/workflows/daily-cli-tools-tester.lock.yml b/.github/workflows/daily-cli-tools-tester.lock.yml
index 0ee74323017..1ceaa25b398 100644
--- a/.github/workflows/daily-cli-tools-tester.lock.yml
+++ b/.github/workflows/daily-cli-tools-tester.lock.yml
@@ -1155,7 +1155,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1945,7 +1944,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/daily-code-metrics.lock.yml b/.github/workflows/daily-code-metrics.lock.yml
index 125b97ad32f..391a37038f4 100644
--- a/.github/workflows/daily-code-metrics.lock.yml
+++ b/.github/workflows/daily-code-metrics.lock.yml
@@ -1277,7 +1277,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -2266,7 +2265,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/daily-compiler-quality.lock.yml b/.github/workflows/daily-compiler-quality.lock.yml
index 75e27090361..0c88ce20d13 100644
--- a/.github/workflows/daily-compiler-quality.lock.yml
+++ b/.github/workflows/daily-compiler-quality.lock.yml
@@ -1195,7 +1195,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -2088,7 +2087,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/daily-credit-limit-test.lock.yml b/.github/workflows/daily-credit-limit-test.lock.yml
index aa1b3691436..a7af08b7a4e 100644
--- a/.github/workflows/daily-credit-limit-test.lock.yml
+++ b/.github/workflows/daily-credit-limit-test.lock.yml
@@ -994,7 +994,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-daily-credit-limit-test"
@@ -1484,7 +1483,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/daily-evals-report.lock.yml b/.github/workflows/daily-evals-report.lock.yml
index 8ae7f010005..8ee1ae27ef2 100644
--- a/.github/workflows/daily-evals-report.lock.yml
+++ b/.github/workflows/daily-evals-report.lock.yml
@@ -1207,7 +1207,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -2075,7 +2074,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/daily-experiment-report.lock.yml b/.github/workflows/daily-experiment-report.lock.yml
index c3217a8308a..cd3c34ab683 100644
--- a/.github/workflows/daily-experiment-report.lock.yml
+++ b/.github/workflows/daily-experiment-report.lock.yml
@@ -1180,7 +1180,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
       pull-requests: write
@@ -1983,7 +1982,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
       pull-requests: write
diff --git a/.github/workflows/daily-fact.lock.yml b/.github/workflows/daily-fact.lock.yml
index 5b2b437f93c..a78089d905e 100644
--- a/.github/workflows/daily-fact.lock.yml
+++ b/.github/workflows/daily-fact.lock.yml
@@ -1304,7 +1304,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -2261,7 +2260,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/daily-file-diet.lock.yml b/.github/workflows/daily-file-diet.lock.yml
index a859c76562d..6a84de892da 100644
--- a/.github/workflows/daily-file-diet.lock.yml
+++ b/.github/workflows/daily-file-diet.lock.yml
@@ -1117,7 +1117,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-daily-file-diet"
@@ -1971,7 +1970,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/daily-firewall-report.lock.yml b/.github/workflows/daily-firewall-report.lock.yml
index c8a291d228c..2a811ab5104 100644
--- a/.github/workflows/daily-firewall-report.lock.yml
+++ b/.github/workflows/daily-firewall-report.lock.yml
@@ -1119,7 +1119,6 @@ jobs:
     runs-on: ubuntu-slim
     permissions:
       actions: write
-      contents: read
     concurrency:
       group: "gh-aw-conclusion-daily-firewall-report"
       cancel-in-progress: false
@@ -1941,8 +1940,7 @@ jobs:
       - detection
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
-    permissions:
-      contents: read
+    permissions: {}
     timeout-minutes: 45
     env:
       GH_AW_AGENT_AIC: ${{ needs.agent.outputs.aic }}
diff --git a/.github/workflows/daily-formal-spec-verifier.lock.yml b/.github/workflows/daily-formal-spec-verifier.lock.yml
index 0760145cec7..f6e34d16260 100644
--- a/.github/workflows/daily-formal-spec-verifier.lock.yml
+++ b/.github/workflows/daily-formal-spec-verifier.lock.yml
@@ -1159,7 +1159,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-daily-formal-spec-verifier"
@@ -1754,7 +1753,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/daily-function-namer.lock.yml b/.github/workflows/daily-function-namer.lock.yml
index 7bd92e01e97..bc779084a5a 100644
--- a/.github/workflows/daily-function-namer.lock.yml
+++ b/.github/workflows/daily-function-namer.lock.yml
@@ -1117,7 +1117,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1890,7 +1889,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/daily-geo-optimizer.lock.yml b/.github/workflows/daily-geo-optimizer.lock.yml
index 83fe39fe51d..3613ea538fe 100644
--- a/.github/workflows/daily-geo-optimizer.lock.yml
+++ b/.github/workflows/daily-geo-optimizer.lock.yml
@@ -1108,7 +1108,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1981,7 +1980,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/daily-github-docs-seo-optimizer.lock.yml b/.github/workflows/daily-github-docs-seo-optimizer.lock.yml
index 76877f79e2d..edb3c4e80a3 100644
--- a/.github/workflows/daily-github-docs-seo-optimizer.lock.yml
+++ b/.github/workflows/daily-github-docs-seo-optimizer.lock.yml
@@ -919,7 +919,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-daily-github-docs-seo-optimizer"
@@ -1439,7 +1438,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/daily-graft-intelligence.lock.yml b/.github/workflows/daily-graft-intelligence.lock.yml
index 96554445bac..e3e8b225015 100644
--- a/.github/workflows/daily-graft-intelligence.lock.yml
+++ b/.github/workflows/daily-graft-intelligence.lock.yml
@@ -1093,7 +1093,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-daily-graft-intelligence"
@@ -1894,7 +1893,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/daily-hippo-learn.lock.yml b/.github/workflows/daily-hippo-learn.lock.yml
index 2eebca22ae6..53f8a38a651 100644
--- a/.github/workflows/daily-hippo-learn.lock.yml
+++ b/.github/workflows/daily-hippo-learn.lock.yml
@@ -1211,7 +1211,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1986,7 +1985,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/daily-issues-report.lock.yml b/.github/workflows/daily-issues-report.lock.yml
index e90c433c08d..dcc6bbd5309 100644
--- a/.github/workflows/daily-issues-report.lock.yml
+++ b/.github/workflows/daily-issues-report.lock.yml
@@ -1362,7 +1362,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -2254,7 +2253,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/daily-malicious-code-scan.lock.yml b/.github/workflows/daily-malicious-code-scan.lock.yml
index da5fcd92bd8..394f64efbca 100644
--- a/.github/workflows/daily-malicious-code-scan.lock.yml
+++ b/.github/workflows/daily-malicious-code-scan.lock.yml
@@ -1074,7 +1074,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
       security-events: write
@@ -1634,7 +1633,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
       security-events: write
diff --git a/.github/workflows/daily-max-ai-credits-test.lock.yml b/.github/workflows/daily-max-ai-credits-test.lock.yml
index eb168813635..5222fd4f563 100644
--- a/.github/workflows/daily-max-ai-credits-test.lock.yml
+++ b/.github/workflows/daily-max-ai-credits-test.lock.yml
@@ -935,7 +935,6 @@ jobs:
       needs.activation.outputs.oauth_token_check_failed == 'true' || needs.activation.outputs.stale_lock_file_failed == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-daily-max-ai-credits-test"
@@ -1383,7 +1382,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/daily-mcp-concurrency-analysis.lock.yml b/.github/workflows/daily-mcp-concurrency-analysis.lock.yml
index 0ecdd23e290..8e174f74245 100644
--- a/.github/workflows/daily-mcp-concurrency-analysis.lock.yml
+++ b/.github/workflows/daily-mcp-concurrency-analysis.lock.yml
@@ -1199,7 +1199,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -2006,7 +2005,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/daily-model-inventory.lock.yml b/.github/workflows/daily-model-inventory.lock.yml
index ef3746fd7f6..5e0286edafc 100644
--- a/.github/workflows/daily-model-inventory.lock.yml
+++ b/.github/workflows/daily-model-inventory.lock.yml
@@ -1386,7 +1386,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-daily-model-inventory"
@@ -2187,7 +2186,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/daily-model-resolution.lock.yml b/.github/workflows/daily-model-resolution.lock.yml
index 5e39c4d5ffe..9d836817878 100644
--- a/.github/workflows/daily-model-resolution.lock.yml
+++ b/.github/workflows/daily-model-resolution.lock.yml
@@ -1130,7 +1130,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-daily-model-resolution"
@@ -1624,7 +1623,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/daily-multi-device-docs-tester.lock.yml b/.github/workflows/daily-multi-device-docs-tester.lock.yml
index ba003e65582..2432fa97c93 100644
--- a/.github/workflows/daily-multi-device-docs-tester.lock.yml
+++ b/.github/workflows/daily-multi-device-docs-tester.lock.yml
@@ -1109,7 +1109,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1597,7 +1596,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/daily-news.lock.yml b/.github/workflows/daily-news.lock.yml
index b4ab86d4338..954fcbf7ea0 100644
--- a/.github/workflows/daily-news.lock.yml
+++ b/.github/workflows/daily-news.lock.yml
@@ -1288,7 +1288,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -2248,7 +2247,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/daily-observability-report.lock.yml b/.github/workflows/daily-observability-report.lock.yml
index 14dfc4c4fd9..997b1e7069f 100644
--- a/.github/workflows/daily-observability-report.lock.yml
+++ b/.github/workflows/daily-observability-report.lock.yml
@@ -1166,7 +1166,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -2034,7 +2033,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/daily-performance-summary.lock.yml b/.github/workflows/daily-performance-summary.lock.yml
index 5391e86ace8..8c8cbcb24e2 100644
--- a/.github/workflows/daily-performance-summary.lock.yml
+++ b/.github/workflows/daily-performance-summary.lock.yml
@@ -1654,7 +1654,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -2459,7 +2458,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/daily-regulatory.lock.yml b/.github/workflows/daily-regulatory.lock.yml
index 9d780c80a87..81e42262275 100644
--- a/.github/workflows/daily-regulatory.lock.yml
+++ b/.github/workflows/daily-regulatory.lock.yml
@@ -1550,7 +1550,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -2376,7 +2375,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/daily-reliability-review.lock.yml b/.github/workflows/daily-reliability-review.lock.yml
index 5cf0228d730..c95c58020ca 100644
--- a/.github/workflows/daily-reliability-review.lock.yml
+++ b/.github/workflows/daily-reliability-review.lock.yml
@@ -1172,7 +1172,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-daily-reliability-review"
@@ -1970,7 +1969,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/daily-repo-chronicle.lock.yml b/.github/workflows/daily-repo-chronicle.lock.yml
index e80e3872e5d..30461aabb43 100644
--- a/.github/workflows/daily-repo-chronicle.lock.yml
+++ b/.github/workflows/daily-repo-chronicle.lock.yml
@@ -1133,7 +1133,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1940,7 +1939,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/daily-safe-output-optimizer.lock.yml b/.github/workflows/daily-safe-output-optimizer.lock.yml
index 915a84e3551..6415f807003 100644
--- a/.github/workflows/daily-safe-output-optimizer.lock.yml
+++ b/.github/workflows/daily-safe-output-optimizer.lock.yml
@@ -1339,7 +1339,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -2318,7 +2317,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/daily-safe-outputs-conformance.lock.yml b/.github/workflows/daily-safe-outputs-conformance.lock.yml
index cd76f79eca8..b901185466c 100644
--- a/.github/workflows/daily-safe-outputs-conformance.lock.yml
+++ b/.github/workflows/daily-safe-outputs-conformance.lock.yml
@@ -1126,7 +1126,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1961,7 +1960,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/daily-secrets-analysis.lock.yml b/.github/workflows/daily-secrets-analysis.lock.yml
index 8597f6331be..e9cf41190b5 100644
--- a/.github/workflows/daily-secrets-analysis.lock.yml
+++ b/.github/workflows/daily-secrets-analysis.lock.yml
@@ -1034,7 +1034,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1869,7 +1868,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/daily-security-observability.lock.yml b/.github/workflows/daily-security-observability.lock.yml
index 6e8a6f4309f..0a71e2c28bd 100644
--- a/.github/workflows/daily-security-observability.lock.yml
+++ b/.github/workflows/daily-security-observability.lock.yml
@@ -1258,7 +1258,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -2094,7 +2093,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/daily-security-red-team.lock.yml b/.github/workflows/daily-security-red-team.lock.yml
index 9ebcc4447cc..7694a1a3817 100644
--- a/.github/workflows/daily-security-red-team.lock.yml
+++ b/.github/workflows/daily-security-red-team.lock.yml
@@ -1223,7 +1223,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -2150,7 +2149,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/daily-semgrep-scan.lock.yml b/.github/workflows/daily-semgrep-scan.lock.yml
index e81de256192..bd7af141a7c 100644
--- a/.github/workflows/daily-semgrep-scan.lock.yml
+++ b/.github/workflows/daily-semgrep-scan.lock.yml
@@ -1110,7 +1110,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       security-events: write
     concurrency:
       group: "gh-aw-conclusion-daily-semgrep-scan"
@@ -2018,7 +2017,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       security-events: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/daily-sentrux-report.lock.yml b/.github/workflows/daily-sentrux-report.lock.yml
index bd4e26e8588..757164290e5 100644
--- a/.github/workflows/daily-sentrux-report.lock.yml
+++ b/.github/workflows/daily-sentrux-report.lock.yml
@@ -1086,7 +1086,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -2012,7 +2011,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/daily-skill-optimizer.lock.yml b/.github/workflows/daily-skill-optimizer.lock.yml
index 3135261718c..403376f4c61 100644
--- a/.github/workflows/daily-skill-optimizer.lock.yml
+++ b/.github/workflows/daily-skill-optimizer.lock.yml
@@ -1052,7 +1052,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-daily-skill-optimizer"
@@ -1882,7 +1881,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/daily-spdd-spec-planner.lock.yml b/.github/workflows/daily-spdd-spec-planner.lock.yml
index 331c5b0e546..23070831164 100644
--- a/.github/workflows/daily-spdd-spec-planner.lock.yml
+++ b/.github/workflows/daily-spdd-spec-planner.lock.yml
@@ -1119,7 +1119,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-daily-spdd-spec-planner"
@@ -1647,7 +1646,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/daily-spending-forecast.lock.yml b/.github/workflows/daily-spending-forecast.lock.yml
index 94e9d56fbb9..a1f9aeb0367 100644
--- a/.github/workflows/daily-spending-forecast.lock.yml
+++ b/.github/workflows/daily-spending-forecast.lock.yml
@@ -1109,7 +1109,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-daily-spending-forecast"
@@ -1629,7 +1628,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/daily-squid-image-scan.lock.yml b/.github/workflows/daily-squid-image-scan.lock.yml
index 972045c280f..7b034c878f3 100644
--- a/.github/workflows/daily-squid-image-scan.lock.yml
+++ b/.github/workflows/daily-squid-image-scan.lock.yml
@@ -1027,7 +1027,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-daily-squid-image-scan"
@@ -1547,7 +1546,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/daily-syntax-error-quality.lock.yml b/.github/workflows/daily-syntax-error-quality.lock.yml
index a00a24de638..8f01eac29ac 100644
--- a/.github/workflows/daily-syntax-error-quality.lock.yml
+++ b/.github/workflows/daily-syntax-error-quality.lock.yml
@@ -1055,7 +1055,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-daily-syntax-error-quality"
@@ -1887,7 +1886,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/daily-team-evolution-insights.lock.yml b/.github/workflows/daily-team-evolution-insights.lock.yml
index d77df5968a3..9958ca30a72 100644
--- a/.github/workflows/daily-team-evolution-insights.lock.yml
+++ b/.github/workflows/daily-team-evolution-insights.lock.yml
@@ -1092,7 +1092,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1623,7 +1622,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/daily-team-status.lock.yml b/.github/workflows/daily-team-status.lock.yml
index 0f68938cd5a..746e2777704 100644
--- a/.github/workflows/daily-team-status.lock.yml
+++ b/.github/workflows/daily-team-status.lock.yml
@@ -1019,7 +1019,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-daily-team-status"
@@ -1546,7 +1545,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/daily-testify-uber-super-expert.lock.yml b/.github/workflows/daily-testify-uber-super-expert.lock.yml
index a761aeb48b1..69559028ce9 100644
--- a/.github/workflows/daily-testify-uber-super-expert.lock.yml
+++ b/.github/workflows/daily-testify-uber-super-expert.lock.yml
@@ -1164,7 +1164,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-daily-testify-uber-super-expert"
@@ -1815,7 +1814,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/daily-token-consumption-report.lock.yml b/.github/workflows/daily-token-consumption-report.lock.yml
index d49d1974a05..304286cc655 100644
--- a/.github/workflows/daily-token-consumption-report.lock.yml
+++ b/.github/workflows/daily-token-consumption-report.lock.yml
@@ -1243,7 +1243,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1740,7 +1739,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/daily-vulnhunter-scan.lock.yml b/.github/workflows/daily-vulnhunter-scan.lock.yml
index 5ad10166706..1d0551f76d4 100644
--- a/.github/workflows/daily-vulnhunter-scan.lock.yml
+++ b/.github/workflows/daily-vulnhunter-scan.lock.yml
@@ -1100,7 +1100,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-daily-vulnhunter-scan"
@@ -1927,7 +1926,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/daily-windows-terminal-integration-builder.lock.yml b/.github/workflows/daily-windows-terminal-integration-builder.lock.yml
index edc884a34be..9868300a5df 100644
--- a/.github/workflows/daily-windows-terminal-integration-builder.lock.yml
+++ b/.github/workflows/daily-windows-terminal-integration-builder.lock.yml
@@ -997,7 +997,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-daily-windows-terminal-integration-builder"
@@ -1517,7 +1516,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/dataflow-pr-discussion-dataset.lock.yml b/.github/workflows/dataflow-pr-discussion-dataset.lock.yml
index 54162a13452..e64b53e3e6a 100644
--- a/.github/workflows/dataflow-pr-discussion-dataset.lock.yml
+++ b/.github/workflows/dataflow-pr-discussion-dataset.lock.yml
@@ -1425,7 +1425,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -2441,7 +2440,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/deep-report.lock.yml b/.github/workflows/deep-report.lock.yml
index 0a9d0636840..d0a1df7b3bd 100644
--- a/.github/workflows/deep-report.lock.yml
+++ b/.github/workflows/deep-report.lock.yml
@@ -1598,7 +1598,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -2621,7 +2620,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/deepsec-security-scan.lock.yml b/.github/workflows/deepsec-security-scan.lock.yml
index 6463def5cd4..cbdeb15ad02 100644
--- a/.github/workflows/deepsec-security-scan.lock.yml
+++ b/.github/workflows/deepsec-security-scan.lock.yml
@@ -1135,7 +1135,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-deepsec-security-scan"
@@ -1962,7 +1961,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/delight.lock.yml b/.github/workflows/delight.lock.yml
index 10718300233..9933c59f814 100644
--- a/.github/workflows/delight.lock.yml
+++ b/.github/workflows/delight.lock.yml
@@ -1149,7 +1149,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -2083,7 +2082,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/dependabot-go-checker.lock.yml b/.github/workflows/dependabot-go-checker.lock.yml
index 8b6a6eb222d..e230f28aa93 100644
--- a/.github/workflows/dependabot-go-checker.lock.yml
+++ b/.github/workflows/dependabot-go-checker.lock.yml
@@ -1131,7 +1131,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-dependabot-go-checker"
@@ -2037,7 +2036,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/deployment-incident-monitor.lock.yml b/.github/workflows/deployment-incident-monitor.lock.yml
index cd6d9f04386..d13bcaee60d 100644
--- a/.github/workflows/deployment-incident-monitor.lock.yml
+++ b/.github/workflows/deployment-incident-monitor.lock.yml
@@ -1057,7 +1057,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-deployment-incident-monitor"
@@ -1943,7 +1942,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/designer-drift-audit.lock.yml b/.github/workflows/designer-drift-audit.lock.yml
index 0e56334f874..35999bfc8f2 100644
--- a/.github/workflows/designer-drift-audit.lock.yml
+++ b/.github/workflows/designer-drift-audit.lock.yml
@@ -1003,7 +1003,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-designer-drift-audit"
@@ -1523,7 +1522,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/detection-analysis-report.lock.yml b/.github/workflows/detection-analysis-report.lock.yml
index 13bbbdeae66..6d933967847 100644
--- a/.github/workflows/detection-analysis-report.lock.yml
+++ b/.github/workflows/detection-analysis-report.lock.yml
@@ -1277,7 +1277,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1777,7 +1776,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/dev-hawk.lock.yml b/.github/workflows/dev-hawk.lock.yml
index d30ca69b8e7..c7c3b49f8a7 100644
--- a/.github/workflows/dev-hawk.lock.yml
+++ b/.github/workflows/dev-hawk.lock.yml
@@ -1165,7 +1165,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -2041,7 +2040,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/dev.lock.yml b/.github/workflows/dev.lock.yml
index 2d4d89bf165..3b3d3e4fc5f 100644
--- a/.github/workflows/dev.lock.yml
+++ b/.github/workflows/dev.lock.yml
@@ -1129,7 +1129,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-dev"
@@ -1777,7 +1776,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/discussion-task-miner.lock.yml b/.github/workflows/discussion-task-miner.lock.yml
index ad7381c31b8..c8d8b7e2e16 100644
--- a/.github/workflows/discussion-task-miner.lock.yml
+++ b/.github/workflows/discussion-task-miner.lock.yml
@@ -1141,7 +1141,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -2073,7 +2072,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/docs-noob-tester.lock.yml b/.github/workflows/docs-noob-tester.lock.yml
index ed303166850..873be37776b 100644
--- a/.github/workflows/docs-noob-tester.lock.yml
+++ b/.github/workflows/docs-noob-tester.lock.yml
@@ -1095,7 +1095,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1894,7 +1893,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/draft-pr-cleanup.lock.yml b/.github/workflows/draft-pr-cleanup.lock.yml
index 494ea82d5e0..b75e6dc2196 100644
--- a/.github/workflows/draft-pr-cleanup.lock.yml
+++ b/.github/workflows/draft-pr-cleanup.lock.yml
@@ -1078,7 +1078,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -1907,7 +1906,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/duplicate-code-detector.lock.yml b/.github/workflows/duplicate-code-detector.lock.yml
index 4f47c62e589..cc5d8976d4e 100644
--- a/.github/workflows/duplicate-code-detector.lock.yml
+++ b/.github/workflows/duplicate-code-detector.lock.yml
@@ -1139,7 +1139,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-duplicate-code-detector"
@@ -1999,7 +1998,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/eslint-monster.lock.yml b/.github/workflows/eslint-monster.lock.yml
index 10f98fcfab7..32a0d5e5978 100644
--- a/.github/workflows/eslint-monster.lock.yml
+++ b/.github/workflows/eslint-monster.lock.yml
@@ -1172,7 +1172,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1693,7 +1692,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/eslint-refiner.lock.yml b/.github/workflows/eslint-refiner.lock.yml
index 14e9ae8f3f3..32d5daac2f3 100644
--- a/.github/workflows/eslint-refiner.lock.yml
+++ b/.github/workflows/eslint-refiner.lock.yml
@@ -1182,7 +1182,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1811,7 +1810,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/example-failure-category-filter.lock.yml b/.github/workflows/example-failure-category-filter.lock.yml
index a99fff09c3a..ca3e9ab292d 100644
--- a/.github/workflows/example-failure-category-filter.lock.yml
+++ b/.github/workflows/example-failure-category-filter.lock.yml
@@ -986,7 +986,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-example-failure-category-filter"
@@ -1507,7 +1506,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/example-permissions-warning.lock.yml b/.github/workflows/example-permissions-warning.lock.yml
index 66455772d8d..4841f221629 100644
--- a/.github/workflows/example-permissions-warning.lock.yml
+++ b/.github/workflows/example-permissions-warning.lock.yml
@@ -959,7 +959,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-example-permissions-warning"
@@ -1151,7 +1150,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/example-workflow-analyzer.lock.yml b/.github/workflows/example-workflow-analyzer.lock.yml
index 2fd6b865d7a..f3b287caee1 100644
--- a/.github/workflows/example-workflow-analyzer.lock.yml
+++ b/.github/workflows/example-workflow-analyzer.lock.yml
@@ -1174,7 +1174,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1666,7 +1665,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/firewall-escape.lock.yml b/.github/workflows/firewall-escape.lock.yml
index c7bb6b1ceed..c07d4a2179a 100644
--- a/.github/workflows/firewall-escape.lock.yml
+++ b/.github/workflows/firewall-escape.lock.yml
@@ -1138,7 +1138,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1852,7 +1851,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/firewall.lock.yml b/.github/workflows/firewall.lock.yml
index 849c201c1c6..7fcf4f3a335 100644
--- a/.github/workflows/firewall.lock.yml
+++ b/.github/workflows/firewall.lock.yml
@@ -962,7 +962,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-firewall"
@@ -1154,7 +1153,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/github-mcp-structural-analysis.lock.yml b/.github/workflows/github-mcp-structural-analysis.lock.yml
index 6590a5c3e41..f0f0781cc15 100644
--- a/.github/workflows/github-mcp-structural-analysis.lock.yml
+++ b/.github/workflows/github-mcp-structural-analysis.lock.yml
@@ -1191,7 +1191,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1686,7 +1685,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/github-remote-mcp-auth-test.lock.yml b/.github/workflows/github-remote-mcp-auth-test.lock.yml
index 1730404a21a..2305adc6732 100644
--- a/.github/workflows/github-remote-mcp-auth-test.lock.yml
+++ b/.github/workflows/github-remote-mcp-auth-test.lock.yml
@@ -1041,7 +1041,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1533,7 +1532,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/go-fan.lock.yml b/.github/workflows/go-fan.lock.yml
index 7b31b3f4a8e..cea64ab811c 100644
--- a/.github/workflows/go-fan.lock.yml
+++ b/.github/workflows/go-fan.lock.yml
@@ -1220,7 +1220,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-go-fan"
@@ -1751,7 +1750,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/go-pattern-detector.lock.yml b/.github/workflows/go-pattern-detector.lock.yml
index f4f1fbae60c..e3463a56bb8 100644
--- a/.github/workflows/go-pattern-detector.lock.yml
+++ b/.github/workflows/go-pattern-detector.lock.yml
@@ -1162,7 +1162,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-go-pattern-detector"
@@ -1685,7 +1684,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/gpclean.lock.yml b/.github/workflows/gpclean.lock.yml
index 20e4b82877e..9b6ea98b1a6 100644
--- a/.github/workflows/gpclean.lock.yml
+++ b/.github/workflows/gpclean.lock.yml
@@ -1133,7 +1133,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-gpclean"
@@ -2042,7 +2041,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/grumpy-reviewer.lock.yml b/.github/workflows/grumpy-reviewer.lock.yml
index 89a5942af69..b9c545d001c 100644
--- a/.github/workflows/grumpy-reviewer.lock.yml
+++ b/.github/workflows/grumpy-reviewer.lock.yml
@@ -1181,7 +1181,6 @@ jobs:
     runs-on: ubuntu-slim
     permissions:
       checks: write
-      contents: read
       pull-requests: write
     concurrency:
       group: "gh-aw-conclusion-grumpy-reviewer"
@@ -1836,7 +1835,6 @@ jobs:
     runs-on: ubuntu-slim
     permissions:
       checks: write
-      contents: read
       pull-requests: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/hippo-embed.lock.yml b/.github/workflows/hippo-embed.lock.yml
index a6025b7dc62..6fa312e81fc 100644
--- a/.github/workflows/hippo-embed.lock.yml
+++ b/.github/workflows/hippo-embed.lock.yml
@@ -1091,7 +1091,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-hippo-embed"
@@ -1277,7 +1276,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/impeccable-skills-reviewer.lock.yml b/.github/workflows/impeccable-skills-reviewer.lock.yml
index 835f0b356e5..a921d2b0e59 100644
--- a/.github/workflows/impeccable-skills-reviewer.lock.yml
+++ b/.github/workflows/impeccable-skills-reviewer.lock.yml
@@ -1160,7 +1160,6 @@ jobs:
     runs-on: ubuntu-slim
     permissions:
       checks: write
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -1730,7 +1729,6 @@ jobs:
     runs-on: ubuntu-slim
     permissions:
       checks: write
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/issue-arborist.lock.yml b/.github/workflows/issue-arborist.lock.yml
index 7225e35fd8d..2d82522a01a 100644
--- a/.github/workflows/issue-arborist.lock.yml
+++ b/.github/workflows/issue-arborist.lock.yml
@@ -1225,7 +1225,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -2245,7 +2244,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/issue-monster.lock.yml b/.github/workflows/issue-monster.lock.yml
index 2fa6c9e857b..2e275971a90 100644
--- a/.github/workflows/issue-monster.lock.yml
+++ b/.github/workflows/issue-monster.lock.yml
@@ -1445,7 +1445,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -2704,7 +2703,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/issue-triage-agent.lock.yml b/.github/workflows/issue-triage-agent.lock.yml
index f92defa6c31..68f51b9b73b 100644
--- a/.github/workflows/issue-triage-agent.lock.yml
+++ b/.github/workflows/issue-triage-agent.lock.yml
@@ -1214,7 +1214,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -2033,7 +2032,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/lint-monster.lock.yml b/.github/workflows/lint-monster.lock.yml
index 77cebd7d6dd..15a00d995ab 100644
--- a/.github/workflows/lint-monster.lock.yml
+++ b/.github/workflows/lint-monster.lock.yml
@@ -1167,7 +1167,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1688,7 +1687,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/lockfile-stats.lock.yml b/.github/workflows/lockfile-stats.lock.yml
index 87e05366a14..8fbafbd3eaa 100644
--- a/.github/workflows/lockfile-stats.lock.yml
+++ b/.github/workflows/lockfile-stats.lock.yml
@@ -1131,7 +1131,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1660,7 +1659,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/mattpocock-skills-reviewer.lock.yml b/.github/workflows/mattpocock-skills-reviewer.lock.yml
index cc9910940e5..8556d599caf 100644
--- a/.github/workflows/mattpocock-skills-reviewer.lock.yml
+++ b/.github/workflows/mattpocock-skills-reviewer.lock.yml
@@ -1309,7 +1309,6 @@ jobs:
     runs-on: ubuntu-slim
     permissions:
       checks: write
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -1913,7 +1912,6 @@ jobs:
     runs-on: ubuntu-slim
     permissions:
       checks: write
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/mcp-inspector.lock.yml b/.github/workflows/mcp-inspector.lock.yml
index 8fe8e5eb78c..92abb264e63 100644
--- a/.github/workflows/mcp-inspector.lock.yml
+++ b/.github/workflows/mcp-inspector.lock.yml
@@ -1601,7 +1601,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -2393,7 +2392,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/metrics-collector.lock.yml b/.github/workflows/metrics-collector.lock.yml
index 07ebd12b12f..285011ae83a 100644
--- a/.github/workflows/metrics-collector.lock.yml
+++ b/.github/workflows/metrics-collector.lock.yml
@@ -1173,7 +1173,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-metrics-collector"
@@ -1791,7 +1790,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/objective-impact-report.lock.yml b/.github/workflows/objective-impact-report.lock.yml
index ac2b1ec5553..164fd9fb449 100644
--- a/.github/workflows/objective-impact-report.lock.yml
+++ b/.github/workflows/objective-impact-report.lock.yml
@@ -1090,7 +1090,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-objective-impact-report"
@@ -1610,7 +1609,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/org-health-report.lock.yml b/.github/workflows/org-health-report.lock.yml
index 94bac53dba0..be893badabe 100644
--- a/.github/workflows/org-health-report.lock.yml
+++ b/.github/workflows/org-health-report.lock.yml
@@ -1156,7 +1156,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1682,7 +1681,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/outcome-collector.lock.yml b/.github/workflows/outcome-collector.lock.yml
index adaa550dd05..d11594e3abb 100644
--- a/.github/workflows/outcome-collector.lock.yml
+++ b/.github/workflows/outcome-collector.lock.yml
@@ -1093,7 +1093,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-outcome-collector"
@@ -1622,7 +1621,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/pdf-summary.lock.yml b/.github/workflows/pdf-summary.lock.yml
index b29cea670f0..1c7d0a13569 100644
--- a/.github/workflows/pdf-summary.lock.yml
+++ b/.github/workflows/pdf-summary.lock.yml
@@ -1198,7 +1198,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
       pull-requests: write
@@ -1804,7 +1803,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
       pull-requests: write
diff --git a/.github/workflows/plan.lock.yml b/.github/workflows/plan.lock.yml
index cd86235b051..dd81cf1b766 100644
--- a/.github/workflows/plan.lock.yml
+++ b/.github/workflows/plan.lock.yml
@@ -1189,7 +1189,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -2179,7 +2178,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/portfolio-analyst.lock.yml b/.github/workflows/portfolio-analyst.lock.yml
index b96fd1e2cb5..20d73bd958c 100644
--- a/.github/workflows/portfolio-analyst.lock.yml
+++ b/.github/workflows/portfolio-analyst.lock.yml
@@ -1264,7 +1264,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1798,7 +1797,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/pr-code-quality-reviewer.lock.yml b/.github/workflows/pr-code-quality-reviewer.lock.yml
index 8e2b417c962..e4b1dddfbdc 100644
--- a/.github/workflows/pr-code-quality-reviewer.lock.yml
+++ b/.github/workflows/pr-code-quality-reviewer.lock.yml
@@ -1217,7 +1217,6 @@ jobs:
     runs-on: ubuntu-slim
     permissions:
       checks: write
-      contents: read
       pull-requests: write
     concurrency:
       group: "gh-aw-conclusion-pr-code-quality-reviewer"
@@ -2128,7 +2127,6 @@ jobs:
     runs-on: ubuntu-slim
     permissions:
       checks: write
-      contents: read
       pull-requests: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/pr-description-caveman.lock.yml b/.github/workflows/pr-description-caveman.lock.yml
index 6153b61a76d..0784152f16f 100644
--- a/.github/workflows/pr-description-caveman.lock.yml
+++ b/.github/workflows/pr-description-caveman.lock.yml
@@ -1059,7 +1059,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       pull-requests: write
     concurrency:
       group: "gh-aw-conclusion-pr-description-caveman"
@@ -1629,7 +1628,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       pull-requests: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/pr-nitpick-reviewer.lock.yml b/.github/workflows/pr-nitpick-reviewer.lock.yml
index 671d49e4dde..005ea3dc372 100644
--- a/.github/workflows/pr-nitpick-reviewer.lock.yml
+++ b/.github/workflows/pr-nitpick-reviewer.lock.yml
@@ -1178,7 +1178,6 @@ jobs:
     runs-on: ubuntu-slim
     permissions:
       checks: write
-      contents: read
       discussions: write
       issues: write
       pull-requests: write
@@ -1782,7 +1781,6 @@ jobs:
     runs-on: ubuntu-slim
     permissions:
       checks: write
-      contents: read
       discussions: write
       issues: write
       pull-requests: write
diff --git a/.github/workflows/pr-triage-agent.lock.yml b/.github/workflows/pr-triage-agent.lock.yml
index 5f45e9b1293..ccf003c5bb7 100644
--- a/.github/workflows/pr-triage-agent.lock.yml
+++ b/.github/workflows/pr-triage-agent.lock.yml
@@ -1466,7 +1466,6 @@ jobs:
     runs-on: ubuntu-slim
     permissions:
       checks: write
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -2391,7 +2390,6 @@ jobs:
     runs-on: ubuntu-slim
     permissions:
       checks: write
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/prompt-clustering-analysis.lock.yml b/.github/workflows/prompt-clustering-analysis.lock.yml
index 663a81d739d..55c3572a74a 100644
--- a/.github/workflows/prompt-clustering-analysis.lock.yml
+++ b/.github/workflows/prompt-clustering-analysis.lock.yml
@@ -1310,7 +1310,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1805,7 +1804,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/python-data-charts.lock.yml b/.github/workflows/python-data-charts.lock.yml
index 608a36ccab1..e34b91ee167 100644
--- a/.github/workflows/python-data-charts.lock.yml
+++ b/.github/workflows/python-data-charts.lock.yml
@@ -1223,7 +1223,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1749,7 +1748,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/refactoring-cadence.lock.yml b/.github/workflows/refactoring-cadence.lock.yml
index d6c557b871d..620864573ab 100644
--- a/.github/workflows/refactoring-cadence.lock.yml
+++ b/.github/workflows/refactoring-cadence.lock.yml
@@ -1087,7 +1087,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-refactoring-cadence"
@@ -1675,7 +1674,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/repo-audit-analyzer.lock.yml b/.github/workflows/repo-audit-analyzer.lock.yml
index 2d9ab621512..343c8adaf33 100644
--- a/.github/workflows/repo-audit-analyzer.lock.yml
+++ b/.github/workflows/repo-audit-analyzer.lock.yml
@@ -1079,7 +1079,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1906,7 +1905,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/repo-tree-map.lock.yml b/.github/workflows/repo-tree-map.lock.yml
index b5de75ab779..aab949ac1bb 100644
--- a/.github/workflows/repo-tree-map.lock.yml
+++ b/.github/workflows/repo-tree-map.lock.yml
@@ -1025,7 +1025,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1548,7 +1547,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/repository-quality-improver.lock.yml b/.github/workflows/repository-quality-improver.lock.yml
index 20d08c2f24e..08f60839364 100644
--- a/.github/workflows/repository-quality-improver.lock.yml
+++ b/.github/workflows/repository-quality-improver.lock.yml
@@ -1085,7 +1085,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1611,7 +1610,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/research.lock.yml b/.github/workflows/research.lock.yml
index 43f0ef39a0c..0eabc84d1b9 100644
--- a/.github/workflows/research.lock.yml
+++ b/.github/workflows/research.lock.yml
@@ -1059,7 +1059,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1881,7 +1880,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/safe-output-health.lock.yml b/.github/workflows/safe-output-health.lock.yml
index 0991c7c8466..7b4a4e69a20 100644
--- a/.github/workflows/safe-output-health.lock.yml
+++ b/.github/workflows/safe-output-health.lock.yml
@@ -1250,7 +1250,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1779,7 +1778,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/schema-consistency-checker.lock.yml b/.github/workflows/schema-consistency-checker.lock.yml
index 5b4b564c8be..6c1d83325e4 100644
--- a/.github/workflows/schema-consistency-checker.lock.yml
+++ b/.github/workflows/schema-consistency-checker.lock.yml
@@ -1057,7 +1057,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1574,7 +1573,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/scout.lock.yml b/.github/workflows/scout.lock.yml
index 0974081fa26..d14687b980d 100644
--- a/.github/workflows/scout.lock.yml
+++ b/.github/workflows/scout.lock.yml
@@ -1351,7 +1351,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -1957,7 +1956,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/security-compliance.lock.yml b/.github/workflows/security-compliance.lock.yml
index 037657d1792..97a86666741 100644
--- a/.github/workflows/security-compliance.lock.yml
+++ b/.github/workflows/security-compliance.lock.yml
@@ -1092,7 +1092,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-security-compliance"
@@ -1710,7 +1709,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/security-review.lock.yml b/.github/workflows/security-review.lock.yml
index 1c4a7a1a0ef..7a613a479bd 100644
--- a/.github/workflows/security-review.lock.yml
+++ b/.github/workflows/security-review.lock.yml
@@ -1436,7 +1436,6 @@ jobs:
     runs-on: ubuntu-slim
     permissions:
       checks: write
-      contents: read
       pull-requests: write
     concurrency:
       group: "gh-aw-conclusion-security-review"
@@ -2337,7 +2336,6 @@ jobs:
     runs-on: ubuntu-slim
     permissions:
       checks: write
-      contents: read
       pull-requests: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/semantic-function-refactor.lock.yml b/.github/workflows/semantic-function-refactor.lock.yml
index 9bf642d6971..0e36d999040 100644
--- a/.github/workflows/semantic-function-refactor.lock.yml
+++ b/.github/workflows/semantic-function-refactor.lock.yml
@@ -1208,7 +1208,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-semantic-function-refactor"
@@ -1731,7 +1730,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/sergo.lock.yml b/.github/workflows/sergo.lock.yml
index 908d453529c..c757dba6898 100644
--- a/.github/workflows/sergo.lock.yml
+++ b/.github/workflows/sergo.lock.yml
@@ -1225,7 +1225,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1854,7 +1853,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/sighthound-security-scan.lock.yml b/.github/workflows/sighthound-security-scan.lock.yml
index 7249d82de19..c6fb3ce2ba2 100644
--- a/.github/workflows/sighthound-security-scan.lock.yml
+++ b/.github/workflows/sighthound-security-scan.lock.yml
@@ -1007,7 +1007,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-sighthound-security-scan"
@@ -1527,7 +1526,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/skillet.lock.yml b/.github/workflows/skillet.lock.yml
index c0d2caaa9db..91e1c273388 100644
--- a/.github/workflows/skillet.lock.yml
+++ b/.github/workflows/skillet.lock.yml
@@ -1157,7 +1157,6 @@ jobs:
     runs-on: ubuntu-slim
     permissions:
       checks: write
-      contents: read
       pull-requests: write
     concurrency:
       group: "gh-aw-conclusion-skillet"
@@ -1881,7 +1880,6 @@ jobs:
     runs-on: ubuntu-slim
     permissions:
       checks: write
-      contents: read
       pull-requests: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/smoke-agent-all-merged.lock.yml b/.github/workflows/smoke-agent-all-merged.lock.yml
index c9c5ec87165..699dd409705 100644
--- a/.github/workflows/smoke-agent-all-merged.lock.yml
+++ b/.github/workflows/smoke-agent-all-merged.lock.yml
@@ -1148,7 +1148,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -1754,7 +1753,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/smoke-agent-all-none.lock.yml b/.github/workflows/smoke-agent-all-none.lock.yml
index 4adf32bf09a..37d9ab4941b 100644
--- a/.github/workflows/smoke-agent-all-none.lock.yml
+++ b/.github/workflows/smoke-agent-all-none.lock.yml
@@ -1148,7 +1148,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -1754,7 +1753,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/smoke-agent-public-approved.lock.yml b/.github/workflows/smoke-agent-public-approved.lock.yml
index 8422b024ce9..aaf9e624a18 100644
--- a/.github/workflows/smoke-agent-public-approved.lock.yml
+++ b/.github/workflows/smoke-agent-public-approved.lock.yml
@@ -1197,7 +1197,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -1806,7 +1805,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/smoke-agent-public-none.lock.yml b/.github/workflows/smoke-agent-public-none.lock.yml
index 6366209418e..f03d75d2b27 100644
--- a/.github/workflows/smoke-agent-public-none.lock.yml
+++ b/.github/workflows/smoke-agent-public-none.lock.yml
@@ -1148,7 +1148,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -1754,7 +1753,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/smoke-agent-scoped-approved.lock.yml b/.github/workflows/smoke-agent-scoped-approved.lock.yml
index e585e69fa4e..b822b47a337 100644
--- a/.github/workflows/smoke-agent-scoped-approved.lock.yml
+++ b/.github/workflows/smoke-agent-scoped-approved.lock.yml
@@ -1155,7 +1155,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -1761,7 +1760,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/smoke-antigravity.lock.yml b/.github/workflows/smoke-antigravity.lock.yml
index 328970f778c..d68828fe5d7 100644
--- a/.github/workflows/smoke-antigravity.lock.yml
+++ b/.github/workflows/smoke-antigravity.lock.yml
@@ -1209,7 +1209,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -2168,7 +2167,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/smoke-ci.lock.yml b/.github/workflows/smoke-ci.lock.yml
index 4e12a656f3f..35b6b20d9d3 100644
--- a/.github/workflows/smoke-ci.lock.yml
+++ b/.github/workflows/smoke-ci.lock.yml
@@ -1334,7 +1334,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -1726,7 +1725,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/smoke-claude-on-copilot.lock.yml b/.github/workflows/smoke-claude-on-copilot.lock.yml
index 8307f9c5d94..46fea7efcb5 100644
--- a/.github/workflows/smoke-claude-on-copilot.lock.yml
+++ b/.github/workflows/smoke-claude-on-copilot.lock.yml
@@ -1096,7 +1096,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -1697,7 +1696,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml
index 2feaa5fbdc7..a59d82c3746 100644
--- a/.github/workflows/smoke-claude.lock.yml
+++ b/.github/workflows/smoke-claude.lock.yml
@@ -2035,7 +2035,6 @@ jobs:
     runs-on: ubuntu-slim
     permissions:
       checks: write
-      contents: read
       issues: write
       pull-requests: write
       security-events: write
@@ -2649,7 +2648,6 @@ jobs:
     runs-on: ubuntu-slim
     permissions:
       checks: write
-      contents: read
       issues: write
       pull-requests: write
       security-events: write
diff --git a/.github/workflows/smoke-codex.lock.yml b/.github/workflows/smoke-codex.lock.yml
index 722ae1254f5..5a4089da809 100644
--- a/.github/workflows/smoke-codex.lock.yml
+++ b/.github/workflows/smoke-codex.lock.yml
@@ -1569,7 +1569,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
       pull-requests: write
@@ -2261,7 +2260,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
       pull-requests: write
diff --git a/.github/workflows/smoke-copilot-aoai-apikey.lock.yml b/.github/workflows/smoke-copilot-aoai-apikey.lock.yml
index 16ddfa6f725..40446e59068 100644
--- a/.github/workflows/smoke-copilot-aoai-apikey.lock.yml
+++ b/.github/workflows/smoke-copilot-aoai-apikey.lock.yml
@@ -2254,7 +2254,6 @@ jobs:
     permissions:
       actions: write
       checks: write
-      contents: read
       discussions: write
       issues: write
       pull-requests: write
@@ -3254,7 +3253,6 @@ jobs:
     permissions:
       actions: write
       checks: write
-      contents: read
       discussions: write
       issues: write
       pull-requests: write
diff --git a/.github/workflows/smoke-copilot-aoai-entra.lock.yml b/.github/workflows/smoke-copilot-aoai-entra.lock.yml
index f7ae1e58bd4..73c020a244c 100644
--- a/.github/workflows/smoke-copilot-aoai-entra.lock.yml
+++ b/.github/workflows/smoke-copilot-aoai-entra.lock.yml
@@ -2274,7 +2274,6 @@ jobs:
     permissions:
       actions: write
       checks: write
-      contents: read
       discussions: write
       issues: write
       pull-requests: write
@@ -3286,7 +3285,6 @@ jobs:
     permissions:
       actions: write
       checks: write
-      contents: read
       discussions: write
       issues: write
       pull-requests: write
diff --git a/.github/workflows/smoke-copilot-arm.lock.yml b/.github/workflows/smoke-copilot-arm.lock.yml
index d88593d1200..8954ea50097 100644
--- a/.github/workflows/smoke-copilot-arm.lock.yml
+++ b/.github/workflows/smoke-copilot-arm.lock.yml
@@ -2067,7 +2067,6 @@ jobs:
     runs-on: ubuntu-slim
     permissions:
       actions: write
-      contents: read
       discussions: write
       issues: write
       pull-requests: write
@@ -2678,7 +2677,6 @@ jobs:
     runs-on: ubuntu-slim
     permissions:
       actions: write
-      contents: read
       discussions: write
       issues: write
       pull-requests: write
diff --git a/.github/workflows/smoke-copilot-auto.lock.yml b/.github/workflows/smoke-copilot-auto.lock.yml
index fa9fda3dd97..9ac472b0a88 100644
--- a/.github/workflows/smoke-copilot-auto.lock.yml
+++ b/.github/workflows/smoke-copilot-auto.lock.yml
@@ -1028,7 +1028,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -1616,7 +1615,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/smoke-copilot-mai.lock.yml b/.github/workflows/smoke-copilot-mai.lock.yml
index 91ff55898cc..f3aa205097e 100644
--- a/.github/workflows/smoke-copilot-mai.lock.yml
+++ b/.github/workflows/smoke-copilot-mai.lock.yml
@@ -1099,7 +1099,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -1700,7 +1699,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/smoke-copilot-sdk.lock.yml b/.github/workflows/smoke-copilot-sdk.lock.yml
index b8e386706a5..b659ee835d0 100644
--- a/.github/workflows/smoke-copilot-sdk.lock.yml
+++ b/.github/workflows/smoke-copilot-sdk.lock.yml
@@ -1079,7 +1079,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-smoke-copilot-sdk"
@@ -1679,7 +1678,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/smoke-copilot-small.lock.yml b/.github/workflows/smoke-copilot-small.lock.yml
index cee460d4b69..52706b77b92 100644
--- a/.github/workflows/smoke-copilot-small.lock.yml
+++ b/.github/workflows/smoke-copilot-small.lock.yml
@@ -1073,7 +1073,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-smoke-copilot-small"
@@ -1673,7 +1672,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/smoke-copilot-sub-agents.lock.yml b/.github/workflows/smoke-copilot-sub-agents.lock.yml
index ae47d9d7c51..4b791957db8 100644
--- a/.github/workflows/smoke-copilot-sub-agents.lock.yml
+++ b/.github/workflows/smoke-copilot-sub-agents.lock.yml
@@ -1044,7 +1044,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-smoke-copilot-sub-agents"
@@ -1958,7 +1957,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml
index 47b4ab38eb8..649324c3492 100644
--- a/.github/workflows/smoke-copilot.lock.yml
+++ b/.github/workflows/smoke-copilot.lock.yml
@@ -2267,7 +2267,6 @@ jobs:
     permissions:
       actions: write
       checks: write
-      contents: read
       discussions: write
       issues: write
       pull-requests: write
@@ -3265,7 +3264,6 @@ jobs:
     permissions:
       actions: write
       checks: write
-      contents: read
       discussions: write
       issues: write
       pull-requests: write
diff --git a/.github/workflows/smoke-gemini.lock.yml b/.github/workflows/smoke-gemini.lock.yml
index 87aa1f9027a..43bd315a9be 100644
--- a/.github/workflows/smoke-gemini.lock.yml
+++ b/.github/workflows/smoke-gemini.lock.yml
@@ -1283,7 +1283,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -2252,7 +2251,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/smoke-github-claude.lock.yml b/.github/workflows/smoke-github-claude.lock.yml
index 03d03884574..c1d14cf4bba 100644
--- a/.github/workflows/smoke-github-claude.lock.yml
+++ b/.github/workflows/smoke-github-claude.lock.yml
@@ -1096,7 +1096,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -1697,7 +1696,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/smoke-opencode.lock.yml b/.github/workflows/smoke-opencode.lock.yml
index d637ba0e7b0..4e9fbe992e9 100644
--- a/.github/workflows/smoke-opencode.lock.yml
+++ b/.github/workflows/smoke-opencode.lock.yml
@@ -1204,7 +1204,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -1817,7 +1816,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/smoke-otel-backends.lock.yml b/.github/workflows/smoke-otel-backends.lock.yml
index 5dbb88283ee..d98cf55efd6 100644
--- a/.github/workflows/smoke-otel-backends.lock.yml
+++ b/.github/workflows/smoke-otel-backends.lock.yml
@@ -1260,7 +1260,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-smoke-otel-backends"
@@ -1860,7 +1859,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/smoke-pi.lock.yml b/.github/workflows/smoke-pi.lock.yml
index a02baf85bf5..d291d0bb621 100644
--- a/.github/workflows/smoke-pi.lock.yml
+++ b/.github/workflows/smoke-pi.lock.yml
@@ -1164,7 +1164,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -1761,7 +1760,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/smoke-service-ports.lock.yml b/.github/workflows/smoke-service-ports.lock.yml
index e8c275697f0..10531770fe2 100644
--- a/.github/workflows/smoke-service-ports.lock.yml
+++ b/.github/workflows/smoke-service-ports.lock.yml
@@ -1148,7 +1148,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -1748,7 +1747,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/smoke-temporary-id.lock.yml b/.github/workflows/smoke-temporary-id.lock.yml
index 921f832a224..6585c53109a 100644
--- a/.github/workflows/smoke-temporary-id.lock.yml
+++ b/.github/workflows/smoke-temporary-id.lock.yml
@@ -1250,7 +1250,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -2239,7 +2238,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/smoke-test-tools.lock.yml b/.github/workflows/smoke-test-tools.lock.yml
index ff8d5f6279b..4b62d261402 100644
--- a/.github/workflows/smoke-test-tools.lock.yml
+++ b/.github/workflows/smoke-test-tools.lock.yml
@@ -1178,7 +1178,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -1781,7 +1780,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/smoke-workflow-call-with-inputs.lock.yml b/.github/workflows/smoke-workflow-call-with-inputs.lock.yml
index d18c644576a..3197f15f540 100644
--- a/.github/workflows/smoke-workflow-call-with-inputs.lock.yml
+++ b/.github/workflows/smoke-workflow-call-with-inputs.lock.yml
@@ -1136,7 +1136,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-smoke-workflow-call-with-inputs"
@@ -1705,7 +1704,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/smoke-workflow-call.lock.yml b/.github/workflows/smoke-workflow-call.lock.yml
index b39cabc4b52..9c0da3eabbc 100644
--- a/.github/workflows/smoke-workflow-call.lock.yml
+++ b/.github/workflows/smoke-workflow-call.lock.yml
@@ -1123,7 +1123,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -1694,7 +1693,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/spec-librarian.lock.yml b/.github/workflows/spec-librarian.lock.yml
index e062a8dae3a..a44b18bae8d 100644
--- a/.github/workflows/spec-librarian.lock.yml
+++ b/.github/workflows/spec-librarian.lock.yml
@@ -1129,7 +1129,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-spec-librarian"
@@ -1714,7 +1713,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/stale-pr-cleanup.lock.yml b/.github/workflows/stale-pr-cleanup.lock.yml
index 957f95dcd2c..e618006d274 100644
--- a/.github/workflows/stale-pr-cleanup.lock.yml
+++ b/.github/workflows/stale-pr-cleanup.lock.yml
@@ -1073,7 +1073,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -1896,7 +1895,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/static-analysis-report.lock.yml b/.github/workflows/static-analysis-report.lock.yml
index ed92ce99881..09599661673 100644
--- a/.github/workflows/static-analysis-report.lock.yml
+++ b/.github/workflows/static-analysis-report.lock.yml
@@ -1279,7 +1279,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -1806,7 +1805,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/step-name-alignment.lock.yml b/.github/workflows/step-name-alignment.lock.yml
index 91e99931b2c..dec3623ad70 100644
--- a/.github/workflows/step-name-alignment.lock.yml
+++ b/.github/workflows/step-name-alignment.lock.yml
@@ -1167,7 +1167,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-step-name-alignment"
@@ -1693,7 +1692,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/sub-issue-closer.lock.yml b/.github/workflows/sub-issue-closer.lock.yml
index 34240753bbf..60fcc4dfa8d 100644
--- a/.github/workflows/sub-issue-closer.lock.yml
+++ b/.github/workflows/sub-issue-closer.lock.yml
@@ -1073,7 +1073,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -1893,7 +1892,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/super-linter.lock.yml b/.github/workflows/super-linter.lock.yml
index 81a2eb97c77..88de01d9ed6 100644
--- a/.github/workflows/super-linter.lock.yml
+++ b/.github/workflows/super-linter.lock.yml
@@ -1097,7 +1097,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-super-linter"
@@ -1620,7 +1619,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/terminal-stylist.lock.yml b/.github/workflows/terminal-stylist.lock.yml
index cec7b246d8a..fc1cb681cc7 100644
--- a/.github/workflows/terminal-stylist.lock.yml
+++ b/.github/workflows/terminal-stylist.lock.yml
@@ -1065,7 +1065,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1588,7 +1587,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/test-quality-sentinel.lock.yml b/.github/workflows/test-quality-sentinel.lock.yml
index f3455de1b4d..23f6f04b5b8 100644
--- a/.github/workflows/test-quality-sentinel.lock.yml
+++ b/.github/workflows/test-quality-sentinel.lock.yml
@@ -1194,7 +1194,6 @@ jobs:
       needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -2155,7 +2154,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/typist.lock.yml b/.github/workflows/typist.lock.yml
index 2df026e1958..5b7e73fa964 100644
--- a/.github/workflows/typist.lock.yml
+++ b/.github/workflows/typist.lock.yml
@@ -1189,7 +1189,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -2072,7 +2071,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/uk-ai-operational-resilience.lock.yml b/.github/workflows/uk-ai-operational-resilience.lock.yml
index a80a7daadda..a149545f764 100644
--- a/.github/workflows/uk-ai-operational-resilience.lock.yml
+++ b/.github/workflows/uk-ai-operational-resilience.lock.yml
@@ -1103,7 +1103,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1631,7 +1630,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/video-analyzer.lock.yml b/.github/workflows/video-analyzer.lock.yml
index cdbe0b177cf..442e364b724 100644
--- a/.github/workflows/video-analyzer.lock.yml
+++ b/.github/workflows/video-analyzer.lock.yml
@@ -1048,7 +1048,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-video-analyzer"
@@ -1568,7 +1567,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/visual-regression-checker.lock.yml b/.github/workflows/visual-regression-checker.lock.yml
index fc2df2066d3..d939e6d8b6c 100644
--- a/.github/workflows/visual-regression-checker.lock.yml
+++ b/.github/workflows/visual-regression-checker.lock.yml
@@ -1122,7 +1122,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -1690,7 +1689,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/weekly-issue-summary.lock.yml b/.github/workflows/weekly-issue-summary.lock.yml
index 98162551ae0..ed5ca92c846 100644
--- a/.github/workflows/weekly-issue-summary.lock.yml
+++ b/.github/workflows/weekly-issue-summary.lock.yml
@@ -1119,7 +1119,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1649,7 +1648,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/.github/workflows/workflow-generator.lock.yml b/.github/workflows/workflow-generator.lock.yml
index a7aa622071b..e90b37ccd7e 100644
--- a/.github/workflows/workflow-generator.lock.yml
+++ b/.github/workflows/workflow-generator.lock.yml
@@ -1144,7 +1144,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-workflow-generator"
@@ -1730,7 +1729,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/workflow-health-manager.lock.yml b/.github/workflows/workflow-health-manager.lock.yml
index b57ac2c63e5..aae862e5989 100644
--- a/.github/workflows/workflow-health-manager.lock.yml
+++ b/.github/workflows/workflow-health-manager.lock.yml
@@ -1161,7 +1161,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     concurrency:
@@ -1780,7 +1779,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
       pull-requests: write
     timeout-minutes: 45
diff --git a/.github/workflows/workflow-normalizer.lock.yml b/.github/workflows/workflow-normalizer.lock.yml
index dd0200f5853..131c2d30ab9 100644
--- a/.github/workflows/workflow-normalizer.lock.yml
+++ b/.github/workflows/workflow-normalizer.lock.yml
@@ -1121,7 +1121,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     concurrency:
       group: "gh-aw-conclusion-workflow-normalizer"
@@ -1646,7 +1645,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       issues: write
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/workflow-skill-extractor.lock.yml b/.github/workflows/workflow-skill-extractor.lock.yml
index c2705af33bc..0cb2bd70581 100644
--- a/.github/workflows/workflow-skill-extractor.lock.yml
+++ b/.github/workflows/workflow-skill-extractor.lock.yml
@@ -1091,7 +1091,6 @@ jobs:
       needs.activation.outputs.secret_verification_result == 'failed' || needs.activation.outputs.daily_ai_credits_exceeded == 'true')
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     concurrency:
@@ -1614,7 +1613,6 @@ jobs:
     if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
-      contents: read
       discussions: write
       issues: write
     timeout-minutes: 45
diff --git a/docs/adr/48913-remove-contents-read-from-safe-output-handlers.md b/docs/adr/48913-remove-contents-read-from-safe-output-handlers.md
new file mode 100644
index 00000000000..203970342d5
--- /dev/null
+++ b/docs/adr/48913-remove-contents-read-from-safe-output-handlers.md
@@ -0,0 +1,48 @@
+# ADR-48913: Remove `contents: read` from Output-Only Safe-Output Handlers
+
+**Date**: 2026-07-29
+**Status**: Draft
+**Deciders**: GitHub Agentic Workflows Team
+
+---
+
+### Context
+
+The `safe_outputs` job compiles and dispatches agent-produced outputs (create issue, add comment, add labels, update pull request, etc.) by downloading an NDJSON artifact and calling GitHub APIs. It does **not** check out repository file contents.
+
+Nearly every handler in the job requested `contents: read` as an unconditional baseline, documented as "always included for repository context access." This applied to output-only handlers — those that call only the issues, pull-requests, discussions, checks, security-events, or organization-projects APIs — where no repository file read occurs. The permission had no functional basis for these handlers.
+
+Operators using tightly scoped GitHub Apps (one App per role, each granted the minimum permissions for its job) were forced to grant `contents: read` to an output-only App and justify that grant in security review. The spec's stated rationale ("Repository metadata and context") was insufficient because GitHub App installations already carry implicit `metadata: read`; the broader `contents` scope goes further and is unnecessary for pure output workloads. This was raised in [issue #48882](https://github.com/github/gh-aw/issues/48882).
+
+### Decision
+
+We will remove `contents: read` from the permission sets of all output-only `safe_outputs` handlers and add dedicated factory functions (`NewPermissionsIssuesWrite`, `NewPermissionsPRWrite`, `NewPermissionsDiscussionsWrite`, etc.) that express each handler's actual minimal scope. Handlers that legitimately need `contents` access (`create-pull-request`, `merge-pull-request`, `push-to-pull-request-branch`, `update-pull-request` with `update-branch: true`, `update-release`) retain `contents: write`. The `upload_asset` PermissionBuilder is removed entirely because the `safe_outputs` job never processes `upload_asset` items — those are handled by the separate `publish_assets` job.
+
+### Alternatives Considered
+
+#### Alternative 1: Document the rationale and keep `contents: read`
+
+Document why `contents: read` is universally included (e.g., some implementation detail requires it) without removing it. This would be the right approach if there were a real functional dependency. Analysis of the output path showed no such dependency: the job downloads an artifact and calls GitHub APIs; it does not read repository files. Keeping an unnecessary permission violates least-privilege and does not help operators justify the grant in security review.
+
+#### Alternative 2: Make `contents: read` opt-in per handler configuration
+
+Add a configuration flag allowing operators to request `contents: read` when they believe their workflow needs it. Rejected because the permission is not needed by any current output-only handler. An opt-in mechanism adds complexity without benefit and defers a clear decision; the correct baseline is no permission, not a configurable one.
+
+### Consequences
+
+#### Positive
+- Output-only `safe_outputs` jobs now operate with the minimal permission set required by the APIs they actually call, consistent with the least-privilege principle stated in the spec (section 2.1).
+- Operators using tightly scoped GitHub Apps can configure an issue-writer or comment-writer App without granting repository-content read access, removing a friction point that previously required justification in security review.
+- The `upload_asset` handler registration is simplified: the `safe_outputs` job no longer contributes a spurious `contents: read` for a handler type it never processes.
+
+#### Negative
+- If any undiscovered runtime dependency on `contents: read` exists in an output handler (e.g., a third-party action invoked within the job that silently relied on the token scope), it would fail at runtime rather than at permission-grant time. Such a failure would be visible in job logs but could surface unexpectedly in production before being caught.
+- Existing operator workflows that hardcode `contents: read` in their `safe-outputs` job permissions block will no longer have that permission contributed by the handler factories; they must supply it explicitly if needed for another reason. This is unlikely to break anything but requires awareness.
+
+#### Neutral
+- The spec is bumped to v1.27.0 and all permission tables for output-only handlers are updated to reflect the minimal sets, giving operators accurate documentation for the first time.
+- Twelve new factory functions are added to `permissions_factory.go`; the previous `NewPermissionsContentsRead*` variants remain for handlers that still need `contents` access, keeping backwards compatibility within the codebase.
+
+---
+
+*ADR created by [adr-writer agent]. Review and finalize before changing status from Draft to Accepted.*
diff --git a/docs/src/content/docs/specs/safe-outputs-specification.md b/docs/src/content/docs/specs/safe-outputs-specification.md
index f7f92bf249b..376c011a167 100644
--- a/docs/src/content/docs/specs/safe-outputs-specification.md
+++ b/docs/src/content/docs/specs/safe-outputs-specification.md
@@ -7,9 +7,9 @@ sidebar:
 
 # Safe Outputs MCP Gateway Specification
 
-**Version**: 1.26.0  
+**Version**: 1.27.0  
 **Status**: Working Draft  
-**Publication Date**: 2026-07-16  
+**Publication Date**: 2026-07-29  
 **Editor**: GitHub Agentic Workflows Team  
 **This Version**: [safe-outputs-specification](/gh-aw/specs/safe-outputs-specification/)  
 **Latest Published Version**: This document
@@ -368,7 +368,6 @@ Each safe output job MUST request minimal permissions. Jobs SHOULD specialize by
 jobs:
   safe-output-create-issue:
     permissions:
-      contents: read
       issues: write  # Minimal for issue creation
 ```
 
@@ -2192,7 +2191,6 @@ The following table defines the exact `createHandlers()` function used for each
 
 *GitHub Actions Token*:
 
-- `contents: read` - Repository metadata and file access
 - `issues: write` - Issue creation and modification
 
 *GitHub App* (if using `safe-outputs.app` configuration):
@@ -2204,7 +2202,6 @@ The following table defines the exact `createHandlers()` function used for each
 
 - Both permission modes require the same write scopes
 - GitHub App permissions enable cross-repository operations beyond `allowed-repos` when properly configured
-- The `contents: read` permission is always included for repository context access
 
 ---
 
@@ -2280,7 +2277,6 @@ This extension applies to safe-output processor messages for `add_comment` (incl
 
 *GitHub Actions Token*:
 
-- `contents: read` - Repository metadata and file access
 - `issues: write` - Comment creation on issues
 - `pull-requests: write` - Comment creation on pull requests
 - `discussions: write` - Comment creation on discussions (only when `discussions: true`)
@@ -2320,7 +2316,6 @@ safe-outputs:
 - Set `discussions: true` to add `discussions:write` and enable commenting on discussions
 - Discussion-related safe outputs (`create-discussion`, `close-discussion`, `update-discussion`) independently add `discussions:write` permission when configured
 - Cross-repository commenting requires appropriate permissions in target repository
-- The `contents: read` permission is always included for repository context access
 - When `safe-outputs.add-comment.target` is `"*"`, requests MUST include at least one of `item_number`, `pr_number`, or `pr`; `item_number` is the canonical field.
 
 ---
@@ -2570,7 +2565,6 @@ This section provides complete definitions for all remaining safe output types.
 
 *GitHub Actions Token*:
 
-- `contents: read` - Repository metadata and context
 - `issues: write` - Managed comment create/update operations on issues and pull requests
 
 *GitHub App*:
@@ -2641,7 +2635,6 @@ This section provides complete definitions for all remaining safe output types.
 
 *GitHub Actions Token*:
 
-- `contents: read` - Repository metadata and context
 - `issues: write` - Issue modification operations
 
 *GitHub App*:
@@ -2722,7 +2715,6 @@ This section provides complete definitions for all remaining safe output types.
 
 *GitHub Actions Token*:
 
-- `contents: read` - Repository metadata and context
 - `issues: write` - Issue state modification and comment creation
 
 *GitHub App*:
@@ -2788,7 +2780,6 @@ This section provides complete definitions for all remaining safe output types.
 
 *GitHub Actions Token*:
 
-- `contents: read` - Repository metadata and context
 - `issues: write` - Issue body modification for task list entries
 
 *GitHub App*:
@@ -2863,7 +2854,6 @@ This section provides complete definitions for all remaining safe output types.
 
 *GitHub Actions Token*:
 
-- `contents: read` - Repository metadata and context
 - `issues: write` - Fallback issue creation when discussion creation fails
 - `discussions: write` - Discussion creation operations
 
@@ -2935,7 +2925,6 @@ This section provides complete definitions for all remaining safe output types.
 
 *GitHub Actions Token*:
 
-- `contents: read` - Repository metadata and context
 - `discussions: write` - Discussion modification operations
 
 *GitHub App*:
@@ -3010,7 +2999,6 @@ This section provides complete definitions for all remaining safe output types.
 
 *GitHub Actions Token*:
 
-- `contents: read` - Repository metadata and context
 - `discussions: write` - Discussion state modification and comment creation
 
 *GitHub App*:
@@ -3032,7 +3020,6 @@ This section provides complete definitions for all remaining safe output types.
 
 *GitHub Actions Token*:
 
-- `contents: read` - Repository metadata and context
 - `pull-requests: write` - Pull request modification operations
 
 *GitHub App*:
@@ -3060,7 +3047,6 @@ This section provides complete definitions for all remaining safe output types.
 
 *GitHub Actions Token*:
 
-- `contents: read` - Repository metadata and context
 - `pull-requests: write` - Pull request state modification and comment creation
 
 *GitHub App*:
@@ -3168,7 +3154,6 @@ This section provides complete definitions for all remaining safe output types.
 
 *GitHub Actions Token*:
 
-- `contents: read` - Repository metadata and context
 - `pull-requests: write` - Pull request draft status modification
 
 *GitHub App*:
@@ -3242,7 +3227,6 @@ This section provides complete definitions for all remaining safe output types.
 
 *GitHub Actions Token*:
 
-- `contents: read` - Repository metadata and diff access
 - `pull-requests: write` - Review comment creation
 
 *GitHub App*:
@@ -3270,7 +3254,6 @@ This section provides complete definitions for all remaining safe output types.
 
 *GitHub Actions Token*:
 
-- `contents: read` - Repository metadata and context
 - `pull-requests: write` - Review submission operations
 
 *GitHub App*:
@@ -3300,7 +3283,6 @@ This section provides complete definitions for all remaining safe output types.
 
 *GitHub Actions Token*:
 
-- `contents: read` - Repository metadata and context
 - `pull-requests: write` - Review thread resolution operations
 
 *GitHub App*:
@@ -3328,7 +3310,6 @@ This section provides complete definitions for all remaining safe output types.
 
 *GitHub Actions Token*:
 
-- `contents: read` - Repository metadata and context
 - `pull-requests: write` - Review comment reply creation
 
 *GitHub App*:
@@ -3356,7 +3337,6 @@ This section provides complete definitions for all remaining safe output types.
 
 *GitHub Actions Token*:
 
-- `contents: read` - Repository metadata and context
 - `issues: write` - Label addition to issues
 - `pull-requests: write` - Label addition to pull requests
 
@@ -3385,7 +3365,6 @@ This section provides complete definitions for all remaining safe output types.
 
 *GitHub Actions Token*:
 
-- `contents: read` - Repository metadata and context
 - `issues: write` - Label removal from issues
 - `pull-requests: write` - Label removal from pull requests
 
@@ -3414,7 +3393,6 @@ This section provides complete definitions for all remaining safe output types.
 
 *GitHub Actions Token*:
 
-- `contents: read` - Repository metadata and context
 - `pull-requests: write` - Reviewer assignment operations
 
 *GitHub App*:
@@ -3441,7 +3419,6 @@ This section provides complete definitions for all remaining safe output types.
 
 *GitHub Actions Token*:
 
-- `contents: read` - Repository metadata and context
 - `issues: write` - Milestone assignment operations
 
 *GitHub App*:
@@ -3490,7 +3467,6 @@ This section provides complete definitions for all remaining safe output types.
 
 *GitHub Actions Token*:
 
-- `contents: read` - Repository metadata and context
 - `issues: write` - Agent assignment operations
 
 *GitHub App*:
@@ -3521,7 +3497,6 @@ This section provides complete definitions for all remaining safe output types.
 
 *GitHub Actions Token*:
 
-- `contents: read` - Repository metadata and context
 - `issues: write` - User assignment operations (for issues)
 - `pull-requests: write` - User assignment operations (for pull requests)
 
@@ -3550,7 +3525,6 @@ This section provides complete definitions for all remaining safe output types.
 
 *GitHub Actions Token*:
 
-- `contents: read` - Repository metadata and context
 - `issues: write` - User unassignment operations
 
 *GitHub App*:
@@ -3580,7 +3554,6 @@ This section provides complete definitions for all remaining safe output types.
 
 *GitHub Actions Token*:
 
-- `contents: read` - Repository metadata and context
 - `issues: write` - Comment hiding on issues
 - `pull-requests: write` - Comment hiding on pull requests
 - `discussions: write` - Comment hiding on discussions (when `discussions: true` or omitted)
@@ -3635,12 +3608,13 @@ safe-outputs:
 
 *GitHub Actions Token*:
 
-- `contents: read` - Repository metadata and context
 - `organization-projects: write` - Project creation operations (note: only valid for GitHub Apps)
+- `issues: read` - Required to resolve issue/PR references when adding items to the project
 
 *GitHub App*:
 
 - `organization-projects: write` - Project creation operations
+- `issues: read` - Required to resolve issue/PR references when adding items to the project
 - `metadata: read` - Repository metadata (automatically granted)
 
 **Notes**:
@@ -3663,12 +3637,13 @@ safe-outputs:
 
 *GitHub Actions Token*:
 
-- `contents: read` - Repository metadata and context
 - `organization-projects: write` - Project management operations (note: only valid for GitHub Apps)
+- `issues: read` - Required to resolve issue/PR references when adding items to the project
 
 *GitHub App*:
 
 - `organization-projects: write` - Project management operations
+- `issues: read` - Required to resolve issue/PR references when adding items to the project
 - `metadata: read` - Repository metadata (automatically granted)
 
 **Notes**:
@@ -3691,7 +3666,6 @@ safe-outputs:
 
 *GitHub Actions Token*:
 
-- `contents: read` - Repository metadata and context
 - `organization-projects: write` - Project status update operations (note: only valid for GitHub Apps)
 
 *GitHub App*:
@@ -3701,7 +3675,7 @@ safe-outputs:
 
 **Notes**:
 
-- Same permission requirements as `create_project` and `update_project`
+- Does not require `issues: read` — status updates operate on the project board itself, not on issue/PR items
 
 ---
 
@@ -3787,7 +3761,7 @@ safe-outputs:
 
 **Notes**:
 
-- Requires ONLY `actions: write` permission (no `contents: read` needed)
+- Requires ONLY `actions: write` permission
 - Target workflow must support `workflow_dispatch` trigger
 - Workflow inputs are validated against target workflow's input schema
 - Cross-repository dispatch requires appropriate `actions: write` permissions in the target repository
@@ -3807,7 +3781,6 @@ safe-outputs:
 
 *GitHub Actions Token*:
 
-- `contents: read` - Repository metadata and context
 - `security-events: write` - SARIF report upload and alert creation
 
 *GitHub App*:
@@ -3835,22 +3808,18 @@ safe-outputs:
 
 *GitHub Actions Token*:
 
-- `contents: read` - Repository metadata and context
 - `security-events: write` - Alert metadata access
 - `actions: read` - Workflow run metadata for alert correlation
 
 *GitHub App*:
 
 - `security-events: write` - Alert metadata access
-- `contents: write` - Pull request branch creation
-- `pull-requests: write` - Pull request creation
 - `actions: read` - Workflow run metadata for alert correlation
 - `metadata: read` - Repository metadata (automatically granted)
 
 **Notes**:
 
-- Most complex permission set - requires security-events, contents, pull-requests, and actions scopes
-- Creates pull request with proposed fix referencing the alert
+- The handler calls the GitHub code-scanning autofix API (`POST /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}/fixes`) directly; it does not create a branch or pull request, so `contents: write` and `pull-requests: write` are not required
 - Alert must exist and be fixable
 
 ---
@@ -3924,12 +3893,10 @@ safe-outputs:
 
 *GitHub Actions Token* (when `target` is NOT configured):
 
-- `contents: read` - Repository metadata and context
 - `checks: write` - Check run creation
 
 *GitHub Actions Token* (when `target` IS configured):
 
-- `contents: read` - Repository metadata and context
 - `checks: write` - Check run creation
 - `pull-requests: read` - PR head SHA resolution via `GET /repos/{owner}/{repo}/pulls/{pull_number}`
 
@@ -3983,7 +3950,6 @@ safe-outputs:
 
 *GitHub Actions Token*:
 
-- `contents: read` - Repository metadata and context
 - `issues: write` - Issue creation and agent assignment
 
 *GitHub App*:
@@ -5346,6 +5312,13 @@ This specification revision aligns with directly relevant `CHANGELOG.md` entries
 - **Earlier changelog entry**: status comments were decoupled from default AI reaction behavior; explicit `on.status-comment` configuration is required when status comments are desired.
 - **Earlier changelog entry**: `command` trigger was renamed to `slash_command` with deprecation compatibility.
 
+**Version 1.27.0** (2026-07-29):
+
+- **Removed**: `contents: read` from the required permissions of all output-only safe-output handlers. The permission was an unconditional baseline with no functional purpose in the `safe_outputs` job for handlers that only call issue, pull-request, discussion, checks, or security-events APIs. Operators who use tightly scoped GitHub Apps no longer need to justify a repository-contents read grant for pure output workloads.
+- **Updated**: Permission tables for `create_issue`, `add_comment`, `close_issue`, `update_issue`, `assign_milestone`, `assign_to_user`, `unassign_from_user`, `assign_to_agent`, `link_sub_issue`, `set_issue_type`, `set_issue_field`, `comment_memory`, `create_discussion`, `update_discussion`, `close_discussion`, `hide_comment`, `add_labels`, `remove_labels`, `replace_label`, `add_reviewer`, `close_pull_request`, `mark_pull_request_as_ready_for_review`, `dismiss_pull_request_review`, `create_pull_request_review_comment`, `submit_pull_request_review`, `reply_to_pull_request_review_comment`, `resolve_pull_request_review_thread`, `update_pull_request` (without `update-branch`), `create_code_scanning_alert`, `autofix_code_scanning_alert`, `create_check_run`, `update_project`, `create_project`, and `create_project_status_update`.
+- **Removed**: `upload_asset` PermissionBuilder — the `safe_outputs` job does not process `upload_asset` items (handled by the dedicated `publish_assets` job with `contents: write`); no permissions are contributed to `safe_outputs` for this handler.
+- **Updated**: Publication metadata to 1.27.0.
+
 **Version 1.26.0** (2026-07-16):
 
 - **Added**: First-class fork-backed pull request semantics for `create_pull_request`, including distinct `target-repo` (upstream) and `head-repo` (automation-owned fork) roles.
@@ -5375,7 +5348,7 @@ This specification revision aligns with directly relevant `CHANGELOG.md` entries
 **Version 1.23.0** (2026-06-10):
 
 - **Added**: `create_check_run` safe output type definition in Section 7.3, including full MCP tool schema, operational semantics, configuration parameters, and permission requirements.
-- **Specified**: Dual-permission profile for `create_check_run`: `contents: read` + `checks: write` when no `target` is configured; adds `pull-requests: read` when `target` is set (required for PR head SHA resolution via `GET /repos/{owner}/{repo}/pulls/{pull_number}`).
+- **Specified**: Dual-permission profile for `create_check_run`: `checks: write` when no `target` is configured; adds `pull-requests: read` when `target` is set (required for PR head SHA resolution via `GET /repos/{owner}/{repo}/pulls/{pull_number}`).
 - **Specified**: SHA resolution order: API-fetched PR head SHA (when `target` configured) → event-payload `pull_request.head.sha` → `GITHUB_SHA` → `context.sha`.
 - **Specified**: Staged-mode behavior: Pulls API call is skipped; preview message includes the resolved PR number when `target` is set.
 - **Updated**: Publication metadata to 1.23.0.
diff --git a/pkg/workflow/add_comment.go b/pkg/workflow/add_comment.go
index e1b47243334..bad1e7b2e69 100644
--- a/pkg/workflow/add_comment.go
+++ b/pkg/workflow/add_comment.go
@@ -124,9 +124,7 @@ func preprocessHideOlderCommentsConfig(configData map[string]any, debugLog *logg
 // PullRequests: nil or true → pull-requests:write (default: true)
 // Discussions: true → discussions:write (default: false)
 func buildAddCommentPermissions(config *AddCommentsConfig) *Permissions {
-	permMap := map[PermissionScope]PermissionLevel{
-		PermissionContents: PermissionRead,
-	}
+	permMap := map[PermissionScope]PermissionLevel{}
 	if config == nil || config.Issues == nil || *config.Issues {
 		permMap[PermissionIssues] = PermissionWrite
 	}
diff --git a/pkg/workflow/compile_outputs_comment_test.go b/pkg/workflow/compile_outputs_comment_test.go
index 7644b1863b4..4e3746085e2 100644
--- a/pkg/workflow/compile_outputs_comment_test.go
+++ b/pkg/workflow/compile_outputs_comment_test.go
@@ -272,7 +272,7 @@ This workflow tests the safe_outputs job generation.
 		t.Error("Expected 45-minute timeout in safe_outputs job")
 	}
 
-	if !strings.Contains(lockContent, "permissions:\n      contents: read\n      issues: write\n      pull-requests: write") {
+	if !strings.Contains(lockContent, "permissions:\n      issues: write\n      pull-requests: write") {
 		t.Error("Expected correct permissions in safe_outputs job (add-comment defaults to no discussions permission)")
 	}
 
diff --git a/pkg/workflow/compile_outputs_label_test.go b/pkg/workflow/compile_outputs_label_test.go
index f7c0a6aa20f..835c26c4985 100644
--- a/pkg/workflow/compile_outputs_label_test.go
+++ b/pkg/workflow/compile_outputs_label_test.go
@@ -132,7 +132,7 @@ This workflow tests the safe_outputs job generation.
 		t.Error("Expected 45-minute timeout in safe_outputs job")
 	}
 
-	if !strings.Contains(lockContent, "permissions:\n      contents: read\n      issues: write\n      pull-requests: write") {
+	if !strings.Contains(lockContent, "permissions:\n      issues: write\n      pull-requests: write") {
 		t.Error("Expected correct permissions in safe_outputs job")
 	}
 
diff --git a/pkg/workflow/compiler_safe_outputs_job_test.go b/pkg/workflow/compiler_safe_outputs_job_test.go
index 5ea797d7217..e5d9604d704 100644
--- a/pkg/workflow/compiler_safe_outputs_job_test.go
+++ b/pkg/workflow/compiler_safe_outputs_job_test.go
@@ -44,7 +44,7 @@ func TestBuildConsolidatedSafeOutputsJob(t *testing.T) {
 			},
 			expectedJobName:  "safe_outputs",
 			checkPermissions: true,
-			expectedPerms:    []string{"contents: read", "issues: write"},
+			expectedPerms:    []string{"issues: write"},
 		},
 		{
 			name: "add comments only",
@@ -57,7 +57,7 @@ func TestBuildConsolidatedSafeOutputsJob(t *testing.T) {
 			},
 			expectedJobName:  "safe_outputs",
 			checkPermissions: true,
-			expectedPerms:    []string{"contents: read", "issues: write", "pull-requests: write"},
+			expectedPerms:    []string{"issues: write", "pull-requests: write"},
 		},
 		{
 			name: "set issue field only",
@@ -66,7 +66,7 @@ func TestBuildConsolidatedSafeOutputsJob(t *testing.T) {
 			},
 			expectedJobName:  "safe_outputs",
 			checkPermissions: true,
-			expectedPerms:    []string{"contents: read", "issues: write"},
+			expectedPerms:    []string{"issues: write"},
 		},
 		{
 			name: "create pull requests with patch",
@@ -99,7 +99,7 @@ func TestBuildConsolidatedSafeOutputsJob(t *testing.T) {
 			},
 			expectedJobName:  "safe_outputs",
 			checkPermissions: true,
-			expectedPerms:    []string{"contents: read", "issues: write", "pull-requests: write"},
+			expectedPerms:    []string{"issues: write", "pull-requests: write"},
 		},
 		{
 			name: "with threat detection enabled",
diff --git a/pkg/workflow/compiler_safe_outputs_steps.go b/pkg/workflow/compiler_safe_outputs_steps.go
index d771bf0121c..5770276f72b 100644
--- a/pkg/workflow/compiler_safe_outputs_steps.go
+++ b/pkg/workflow/compiler_safe_outputs_steps.go
@@ -97,7 +97,12 @@ func (c *Compiler) buildHandlerManagerStep(data *WorkflowData) ([]string, error)
 	// ${{ steps.create-check-run-app-token.outputs.token }}) are resolved at runtime.
 	if data.SafeOutputs != nil && data.SafeOutputs.CreateCheckRun != nil && data.SafeOutputs.CreateCheckRun.GitHubApp != nil {
 		consolidatedSafeOutputsStepsLog.Print("Adding per-handler GitHub App token minting step for create-check-run")
-		permissions := NewPermissionsContentsReadChecksWrite()
+		var permissions *Permissions
+		if data.SafeOutputs.CreateCheckRun.Target != "" {
+			permissions = NewPermissionsChecksWritePRRead()
+		} else {
+			permissions = NewPermissionsChecksWrite()
+		}
 		for _, step := range c.buildGitHubAppTokenMintStep(data.SafeOutputs.CreateCheckRun.GitHubApp, permissions, "") {
 			steps = append(steps, replaceStepID(step, "safe-outputs-app-token", "create-check-run-app-token"))
 		}
diff --git a/pkg/workflow/permissions_factory.go b/pkg/workflow/permissions_factory.go
index babe76107c9..53a5aaad93e 100644
--- a/pkg/workflow/permissions_factory.go
+++ b/pkg/workflow/permissions_factory.go
@@ -211,3 +211,112 @@ func NewPermissionsContentsReadProjectsWrite() *Permissions {
 		PermissionOrganizationProj: PermissionWrite,
 	})
 }
+
+// NewPermissionsIssuesWrite creates permissions with issues: write only.
+// Used for output-only handlers (create-issue, close-issue, etc.) that call the
+// issues API without accessing repository file contents.
+func NewPermissionsIssuesWrite() *Permissions {
+	return NewPermissionsFromMap(map[PermissionScope]PermissionLevel{
+		PermissionIssues: PermissionWrite,
+	})
+}
+
+// NewPermissionsIssuesWritePRWrite creates permissions with issues: write and pull-requests: write.
+// Used for handlers such as add-labels that operate on both issues and pull requests.
+func NewPermissionsIssuesWritePRWrite() *Permissions {
+	return NewPermissionsFromMap(map[PermissionScope]PermissionLevel{
+		PermissionIssues:       PermissionWrite,
+		PermissionPullRequests: PermissionWrite,
+	})
+}
+
+// NewPermissionsDiscussionsWrite creates permissions with discussions: write only.
+// Used for discussion-only output handlers (update-discussion, close-discussion).
+func NewPermissionsDiscussionsWrite() *Permissions {
+	return NewPermissionsFromMap(map[PermissionScope]PermissionLevel{
+		PermissionDiscussions: PermissionWrite,
+	})
+}
+
+// NewPermissionsIssuesWriteDiscussionsWrite creates permissions with issues: write and discussions: write.
+// Used for create-discussion which falls back to issue creation when discussion creation fails.
+func NewPermissionsIssuesWriteDiscussionsWrite() *Permissions {
+	return NewPermissionsFromMap(map[PermissionScope]PermissionLevel{
+		PermissionIssues:      PermissionWrite,
+		PermissionDiscussions: PermissionWrite,
+	})
+}
+
+// NewPermissionsPRWrite creates permissions with pull-requests: write only.
+// Used for pull-request output handlers (add-reviewer, close-pull-request, etc.)
+// that call the pull-requests API without accessing repository file contents.
+func NewPermissionsPRWrite() *Permissions {
+	return NewPermissionsFromMap(map[PermissionScope]PermissionLevel{
+		PermissionPullRequests: PermissionWrite,
+	})
+}
+
+// NewPermissionsSecurityEventsWrite creates permissions with security-events: write only.
+// Used for the create-code-scanning-alert handler in the safe_outputs job, which writes
+// a SARIF file to disk without accessing repository file contents directly.
+func NewPermissionsSecurityEventsWrite() *Permissions {
+	return NewPermissionsFromMap(map[PermissionScope]PermissionLevel{
+		PermissionSecurityEvents: PermissionWrite,
+	})
+}
+
+// NewPermissionsSecurityEventsWriteActionsRead creates permissions with security-events: write and actions: read.
+// Used for the autofix-code-scanning-alert handler which triggers the GitHub code-scanning fixes API.
+func NewPermissionsSecurityEventsWriteActionsRead() *Permissions {
+	return NewPermissionsFromMap(map[PermissionScope]PermissionLevel{
+		PermissionSecurityEvents: PermissionWrite,
+		PermissionActions:        PermissionRead,
+	})
+}
+
+// NewPermissionsChecksWrite creates permissions with checks: write only.
+// Used for the create-check-run handler which creates check runs via the checks API.
+func NewPermissionsChecksWrite() *Permissions {
+	return NewPermissionsFromMap(map[PermissionScope]PermissionLevel{
+		PermissionChecks: PermissionWrite,
+	})
+}
+
+// NewPermissionsChecksWritePRRead creates permissions with checks: write and pull-requests: read.
+// Used when create-check-run has a target configured and must resolve the PR head SHA via the REST API.
+func NewPermissionsChecksWritePRRead() *Permissions {
+	return NewPermissionsFromMap(map[PermissionScope]PermissionLevel{
+		PermissionChecks:       PermissionWrite,
+		PermissionPullRequests: PermissionRead,
+	})
+}
+
+// NewPermissionsIssuesWriteDiscussionsWritePRWrite creates permissions with issues: write, discussions: write,
+// and pull-requests: write.
+func NewPermissionsIssuesWriteDiscussionsWritePRWrite() *Permissions {
+	return NewPermissionsFromMap(map[PermissionScope]PermissionLevel{
+		PermissionIssues:       PermissionWrite,
+		PermissionDiscussions:  PermissionWrite,
+		PermissionPullRequests: PermissionWrite,
+	})
+}
+
+// NewPermissionsOrganizationProjWriteIssuesRead creates permissions with organization-projects: write
+// and issues: read. Used for project-management handlers (update-project, create-project) that read
+// issue metadata when adding items to projects.
+// Note: organization-projects is only valid for GitHub App tokens, not workflow permissions.
+func NewPermissionsOrganizationProjWriteIssuesRead() *Permissions {
+	return NewPermissionsFromMap(map[PermissionScope]PermissionLevel{
+		PermissionOrganizationProj: PermissionWrite,
+		PermissionIssues:           PermissionRead,
+	})
+}
+
+// NewPermissionsOrganizationProjWrite creates permissions with organization-projects: write only.
+// Used for create-project-status-update which only needs to write a project status update.
+// Note: organization-projects is only valid for GitHub App tokens, not workflow permissions.
+func NewPermissionsOrganizationProjWrite() *Permissions {
+	return NewPermissionsFromMap(map[PermissionScope]PermissionLevel{
+		PermissionOrganizationProj: PermissionWrite,
+	})
+}
diff --git a/pkg/workflow/prompts_test.go b/pkg/workflow/prompts_test.go
index e89aa43d325..44afda8327b 100644
--- a/pkg/workflow/prompts_test.go
+++ b/pkg/workflow/prompts_test.go
@@ -432,15 +432,10 @@ func TestDailyAgentOfTheDayBlogWriterHasGitDenialMitigationAllowlist(t *testing.
 	}
 
 	workflow := string(content)
-	for _, expected := range []string{
-		`  - "cd * && git status"`,
-		`  - "git add *"`,
-		`  - "git add * && git commit *"`,
-		`  - "cd * && git checkout -b * && git add * && git commit *"`,
-	} {
-		if !strings.Contains(workflow, expected) {
-			t.Fatalf("Expected Daily Agent of the Day Blog Writer workflow to contain %q", expected)
-		}
+	// The workflow uses bash: ["*"] to allow all bash commands (including git),
+	// which covers the git denial mitigation pattern without needing an explicit allowlist.
+	if !strings.Contains(workflow, `bash: ["*"]`) {
+		t.Fatalf("Expected Daily Agent of the Day Blog Writer workflow to allow all bash commands via bash: [\"*\"]")
 	}
 }
 
diff --git a/pkg/workflow/safe_output_handlers.go b/pkg/workflow/safe_output_handlers.go
index 577e256bdd9..f61b6772a92 100644
--- a/pkg/workflow/safe_output_handlers.go
+++ b/pkg/workflow/safe_output_handlers.go
@@ -28,7 +28,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "CreateIssues") {
 				return nil
 			}
-			return NewPermissionsContentsReadIssuesWrite()
+			return NewPermissionsIssuesWrite()
 		},
 	},
 	{
@@ -41,7 +41,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "CreateAgentSessions") {
 				return nil
 			}
-			return NewPermissionsContentsReadIssuesWrite()
+			return NewPermissionsIssuesWrite()
 		},
 	},
 	{
@@ -53,7 +53,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "CreateDiscussions") {
 				return nil
 			}
-			return NewPermissionsContentsReadIssuesWriteDiscussionsWrite()
+			return NewPermissionsIssuesWriteDiscussionsWrite()
 		},
 	},
 	{
@@ -65,7 +65,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "UpdateDiscussions") {
 				return nil
 			}
-			return NewPermissionsContentsReadDiscussionsWrite()
+			return NewPermissionsDiscussionsWrite()
 		},
 	},
 	{
@@ -77,7 +77,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "CloseDiscussions") {
 				return nil
 			}
-			return NewPermissionsContentsReadDiscussionsWrite()
+			return NewPermissionsDiscussionsWrite()
 		},
 	},
 	{
@@ -89,7 +89,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "CloseIssues") {
 				return nil
 			}
-			return NewPermissionsContentsReadIssuesWrite()
+			return NewPermissionsIssuesWrite()
 		},
 	},
 	{
@@ -101,7 +101,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "ClosePullRequests") {
 				return nil
 			}
-			return NewPermissionsContentsReadPRWrite()
+			return NewPermissionsPRWrite()
 		},
 	},
 	{
@@ -113,7 +113,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "MarkPullRequestAsReadyForReview") {
 				return nil
 			}
-			return NewPermissionsContentsReadPRWrite()
+			return NewPermissionsPRWrite()
 		},
 	},
 	{
@@ -126,7 +126,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "DismissPullRequestReview") {
 				return nil
 			}
-			return NewPermissionsContentsReadPRWrite()
+			return NewPermissionsPRWrite()
 		},
 	},
 	{
@@ -149,7 +149,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "CommentMemory") {
 				return nil
 			}
-			return NewPermissionsContentsReadIssuesWrite()
+			return NewPermissionsIssuesWrite()
 		},
 	},
 	{
@@ -188,7 +188,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "CreatePullRequestReviewComments") {
 				return nil
 			}
-			return NewPermissionsContentsReadPRWrite()
+			return NewPermissionsPRWrite()
 		},
 	},
 	{
@@ -200,7 +200,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "SubmitPullRequestReview") {
 				return nil
 			}
-			return NewPermissionsContentsReadPRWrite()
+			return NewPermissionsPRWrite()
 		},
 	},
 	{
@@ -212,7 +212,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "ReplyToPullRequestReviewComment") {
 				return nil
 			}
-			return NewPermissionsContentsReadPRWrite()
+			return NewPermissionsPRWrite()
 		},
 	},
 	{
@@ -224,7 +224,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "ResolvePullRequestReviewThread") {
 				return nil
 			}
-			return NewPermissionsContentsReadPRWrite()
+			return NewPermissionsPRWrite()
 		},
 	},
 	{
@@ -236,7 +236,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "CreateCodeScanningAlerts") {
 				return nil
 			}
-			return NewPermissionsContentsReadSecurityEventsWrite()
+			return NewPermissionsSecurityEventsWrite()
 		},
 	},
 	{
@@ -248,7 +248,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "AutofixCodeScanningAlert") {
 				return nil
 			}
-			return NewPermissionsContentsReadSecurityEventsWriteActionsRead()
+			return NewPermissionsSecurityEventsWriteActionsRead()
 		},
 	},
 	{
@@ -261,9 +261,9 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 				return nil
 			}
 			if safeOutputs.CreateCheckRun != nil && safeOutputs.CreateCheckRun.Target != "" {
-				return NewPermissionsContentsReadChecksWritePRRead()
+				return NewPermissionsChecksWritePRRead()
 			}
-			return NewPermissionsContentsReadChecksWrite()
+			return NewPermissionsChecksWrite()
 		},
 	},
 	{
@@ -275,7 +275,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "AddLabels") {
 				return nil
 			}
-			return NewPermissionsContentsReadIssuesWritePRWrite()
+			return NewPermissionsIssuesWritePRWrite()
 		},
 	},
 	{
@@ -287,7 +287,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "RemoveLabels") {
 				return nil
 			}
-			return NewPermissionsContentsReadIssuesWritePRWrite()
+			return NewPermissionsIssuesWritePRWrite()
 		},
 	},
 	{
@@ -299,7 +299,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "ReplaceLabel") {
 				return nil
 			}
-			return NewPermissionsContentsReadIssuesWritePRWrite()
+			return NewPermissionsIssuesWritePRWrite()
 		},
 	},
 	{
@@ -311,7 +311,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "AddReviewer") {
 				return nil
 			}
-			return NewPermissionsContentsReadPRWrite()
+			return NewPermissionsPRWrite()
 		},
 	},
 	{
@@ -323,7 +323,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "AssignMilestone") {
 				return nil
 			}
-			return NewPermissionsContentsReadIssuesWrite()
+			return NewPermissionsIssuesWrite()
 		},
 	},
 	{
@@ -335,7 +335,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "AssignToAgent") {
 				return nil
 			}
-			return NewPermissionsContentsReadIssuesWrite()
+			return NewPermissionsIssuesWrite()
 		},
 	},
 	{
@@ -347,7 +347,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "AssignToUser") {
 				return nil
 			}
-			return NewPermissionsContentsReadIssuesWrite()
+			return NewPermissionsIssuesWrite()
 		},
 	},
 	{
@@ -359,7 +359,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "UnassignFromUser") {
 				return nil
 			}
-			return NewPermissionsContentsReadIssuesWrite()
+			return NewPermissionsIssuesWrite()
 		},
 	},
 	{
@@ -371,7 +371,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "UpdateIssues") {
 				return nil
 			}
-			return NewPermissionsContentsReadIssuesWrite()
+			return NewPermissionsIssuesWrite()
 		},
 	},
 	{
@@ -386,7 +386,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if safeOutputs.UpdatePullRequests.UpdateBranch != nil && *safeOutputs.UpdatePullRequests.UpdateBranch {
 				return NewPermissionsContentsWritePRWrite()
 			}
-			return NewPermissionsContentsReadPRWrite()
+			return NewPermissionsPRWrite()
 		},
 	},
 	{
@@ -430,12 +430,6 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 		StructField: "UploadAssets",
 		ToolName:    "upload_asset",
 		NewConfig:   func() any { return &UploadAssetsConfig{} },
-		PermissionBuilder: func(safeOutputs *SafeOutputsConfig) *Permissions {
-			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "UploadAssets") {
-				return nil
-			}
-			return NewPermissionsContentsRead()
-		},
 	},
 	{
 		Key:         "upload-artifact",
@@ -463,9 +457,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "UpdateProjects") {
 				return nil
 			}
-			permissions := NewPermissionsContentsReadProjectsWrite()
-			permissions.Set(PermissionIssues, PermissionRead)
-			return permissions
+			return NewPermissionsOrganizationProjWriteIssuesRead()
 		},
 	},
 	{
@@ -477,9 +469,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "CreateProjects") {
 				return nil
 			}
-			permissions := NewPermissionsContentsReadProjectsWrite()
-			permissions.Set(PermissionIssues, PermissionRead)
-			return permissions
+			return NewPermissionsOrganizationProjWriteIssuesRead()
 		},
 	},
 	{
@@ -491,7 +481,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "CreateProjectStatusUpdates") {
 				return nil
 			}
-			return NewPermissionsContentsReadProjectsWrite()
+			return NewPermissionsOrganizationProjWrite()
 		},
 	},
 	{
@@ -503,7 +493,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "LinkSubIssue") {
 				return nil
 			}
-			return NewPermissionsContentsReadIssuesWrite()
+			return NewPermissionsIssuesWrite()
 		},
 	},
 	{
@@ -516,9 +506,9 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 				return nil
 			}
 			if safeOutputs.HideComment.Discussions != nil && !*safeOutputs.HideComment.Discussions {
-				return NewPermissionsContentsReadIssuesWrite()
+				return NewPermissionsIssuesWrite()
 			}
-			return NewPermissionsContentsReadIssuesWriteDiscussionsWrite()
+			return NewPermissionsIssuesWriteDiscussionsWrite()
 		},
 	},
 	{
@@ -566,7 +556,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "SetIssueType") {
 				return nil
 			}
-			return NewPermissionsContentsReadIssuesWrite()
+			return NewPermissionsIssuesWrite()
 		},
 	},
 	{
@@ -578,7 +568,7 @@ var safeOutputHandlers = []safeOutputHandlerDescriptor{
 			if !isSafeOutputHandlerEnabledAndUnstaged(safeOutputs, "SetIssueField") {
 				return nil
 			}
-			return NewPermissionsContentsReadIssuesWrite()
+			return NewPermissionsIssuesWrite()
 		},
 	},
 	{
diff --git a/pkg/workflow/safe_outputs_app_test.go b/pkg/workflow/safe_outputs_app_test.go
index 88d6b22efdd..c059987f8f4 100644
--- a/pkg/workflow/safe_outputs_app_test.go
+++ b/pkg/workflow/safe_outputs_app_test.go
@@ -307,8 +307,8 @@ Test workflow with discussions permission.
 	// actions/create-github-app-token scopes the token to only those permissions.
 	assert.Contains(t, stepsStr, "permission-discussions: write", "GitHub App token should include discussions write permission")
 	// Other explicitly supported permission inputs should still be present
-	assert.Contains(t, stepsStr, "permission-contents: read", "GitHub App token should include contents read permission")
 	assert.Contains(t, stepsStr, "permission-issues: write", "GitHub App token should include issues write permission (create-discussion falls back to issue)")
+	assert.NotContains(t, stepsStr, "permission-contents: read", "GitHub App token should not include contents read permission for output-only handlers")
 }
 
 // TestSafeOutputsAppTokenUpdateProjectIssuesReadPermission tests that issues read permission
@@ -349,7 +349,7 @@ Test workflow with update-project permissions.
 
 	assert.Contains(t, stepsStr, "permission-organization-projects: write", "GitHub App token should include organization projects write permission")
 	assert.Contains(t, stepsStr, "permission-issues: read", "GitHub App token should include issues read permission for issue-backed project items")
-	assert.Contains(t, stepsStr, "permission-contents: read", "GitHub App token should include contents read permission")
+	assert.NotContains(t, stepsStr, "permission-contents: read", "GitHub App token should not include contents read permission for output-only handlers")
 }
 
 // TestSafeOutputsAppTokenCreateProjectWithItemURLIssuesReadPermission tests that issues read permission
@@ -390,7 +390,7 @@ Test workflow with create-project item_url permissions.
 
 	assert.Contains(t, stepsStr, "permission-organization-projects: write", "GitHub App token should include organization projects write permission")
 	assert.Contains(t, stepsStr, "permission-issues: read", "GitHub App token should include issues read permission for issue-backed project items")
-	assert.Contains(t, stepsStr, "permission-contents: read", "GitHub App token should include contents read permission")
+	assert.NotContains(t, stepsStr, "permission-contents: read", "GitHub App token should not include contents read permission for output-only handlers")
 }
 
 // TestSafeOutputsAppTokenAddCommentAddLabelsIssuesWrite is a regression test for the issue
@@ -449,8 +449,8 @@ Test workflow
 		"App token must use handler-computed issues:write, not workflow-level issues:read")
 	assert.Contains(t, stepsStr, "permission-pull-requests: write",
 		"App token must include pull-requests:write from add-labels handler")
-	assert.Contains(t, stepsStr, "permission-contents: read",
-		"App token must include contents:read")
+	assert.NotContains(t, stepsStr, "permission-contents: read",
+		"App token must not include contents:read for output-only handlers")
 
 	// The job-level permissions YAML must also reflect the handler-computed scope.
 	assert.Contains(t, job.Permissions, "issues: write",
@@ -543,3 +543,74 @@ func TestSafeOutputsAppTokenPermissionsOverride(t *testing.T) {
 	assert.Contains(t, stepsStr, "permission-members: read",
 		"App token must include members:read from github-app.permissions override")
 }
+
+// TestSafeOutputsCreateCheckRunAppTokenMinimalPermissions tests that the per-handler
+// GitHub App token for create-check-run uses minimal permissions (no contents: read).
+// When target is not configured, only checks: write is required.
+// When target is configured, pull-requests: read is added for PR head SHA resolution.
+func TestSafeOutputsCreateCheckRunAppTokenMinimalPermissions(t *testing.T) {
+	compiler := NewCompiler(WithVersion("1.0.0"))
+
+	t.Run("no target - only checks: write", func(t *testing.T) {
+		workflowData := &WorkflowData{
+			Name: "Test Workflow",
+			SafeOutputs: &SafeOutputsConfig{
+				CreateCheckRun: &CreateCheckRunConfig{
+					BaseSafeOutputConfig: BaseSafeOutputConfig{
+						GitHubApp: &GitHubAppConfig{
+							AppID:      "${{ vars.APP_ID }}",
+							PrivateKey: "${{ secrets.APP_PRIVATE_KEY }}",
+						},
+					},
+				},
+			},
+		}
+
+		job, _, err := compiler.buildConsolidatedSafeOutputsJob(workflowData, "agent", "test.md")
+		require.NoError(t, err, "Failed to build safe_outputs job")
+		require.NotNil(t, job, "Job should not be nil")
+
+		stepsStr := strings.Join(job.Steps, "")
+
+		assert.Contains(t, stepsStr, "id: create-check-run-app-token",
+			"Per-handler app token step must be present")
+		assert.Contains(t, stepsStr, "permission-checks: write",
+			"App token must include checks:write")
+		assert.NotContains(t, stepsStr, "permission-pull-requests:",
+			"App token must not include pull-requests permission when no target is configured")
+		assert.NotContains(t, stepsStr, "permission-contents: read",
+			"App token must not include contents:read for create-check-run")
+	})
+
+	t.Run("with target - checks: write and pull-requests: read", func(t *testing.T) {
+		workflowData := &WorkflowData{
+			Name: "Test Workflow",
+			SafeOutputs: &SafeOutputsConfig{
+				CreateCheckRun: &CreateCheckRunConfig{
+					Target: "triggering",
+					BaseSafeOutputConfig: BaseSafeOutputConfig{
+						GitHubApp: &GitHubAppConfig{
+							AppID:      "${{ vars.APP_ID }}",
+							PrivateKey: "${{ secrets.APP_PRIVATE_KEY }}",
+						},
+					},
+				},
+			},
+		}
+
+		job, _, err := compiler.buildConsolidatedSafeOutputsJob(workflowData, "agent", "test.md")
+		require.NoError(t, err, "Failed to build safe_outputs job")
+		require.NotNil(t, job, "Job should not be nil")
+
+		stepsStr := strings.Join(job.Steps, "")
+
+		assert.Contains(t, stepsStr, "id: create-check-run-app-token",
+			"Per-handler app token step must be present")
+		assert.Contains(t, stepsStr, "permission-checks: write",
+			"App token must include checks:write")
+		assert.Contains(t, stepsStr, "permission-pull-requests: read",
+			"App token must include pull-requests:read when target is configured")
+		assert.NotContains(t, stepsStr, "permission-contents: read",
+			"App token must not include contents:read for create-check-run")
+	})
+}
diff --git a/pkg/workflow/safe_outputs_permissions.go b/pkg/workflow/safe_outputs_permissions.go
index 70bfdb18c7b..c45f68647f3 100644
--- a/pkg/workflow/safe_outputs_permissions.go
+++ b/pkg/workflow/safe_outputs_permissions.go
@@ -22,6 +22,35 @@ var oidcVaultActions = []string{
 	"cyberark/conjur-action",                // CyberArk Conjur
 }
 
+// checkoutActions is the list of GitHub Actions that require contents: read to
+// clone or fetch repository contents. When a user-provided safe-output step uses
+// one of these actions, the compiled safe_outputs job must include contents: read
+// so the checkout succeeds in private repositories.
+var checkoutActions = []string{
+	"actions/checkout",
+}
+
+// stepsRequireContentsRead returns true if any of the provided steps use an action
+// that needs to read repository contents (e.g. actions/checkout).
+func stepsRequireContentsRead(steps []any) bool {
+	for _, step := range steps {
+		stepMap, ok := step.(map[string]any)
+		if !ok {
+			continue
+		}
+		uses, ok := stepMap["uses"].(string)
+		if !ok || uses == "" {
+			continue
+		}
+		// Strip the @version suffix before matching
+		actionRef, _, _ := strings.Cut(uses, "@")
+		if slices.Contains(checkoutActions, actionRef) {
+			return true
+		}
+	}
+	return false
+}
+
 // stepsRequireIDToken returns true if any of the provided steps use a known
 // OIDC/secret-vault action that requires the id-token: write permission.
 func stepsRequireIDToken(steps []any) bool {
@@ -114,6 +143,14 @@ func ComputePermissionsForSafeOutputs(safeOutputs *SafeOutputsConfig) *Permissio
 		permissions.Set(PermissionIdToken, PermissionWrite)
 	}
 
+	// Auto-detect checkout actions in user-provided steps and add contents: read.
+	// Without this, private-repository checkouts in safe-output steps would fail
+	// because the safe_outputs job would not include a contents permission.
+	if stepsRequireContentsRead(safeOutputs.Steps) {
+		safeOutputsPermissionsLog.Print("Auto-detected checkout action in steps; adding contents: read")
+		permissions.Set(PermissionContents, PermissionRead)
+	}
+
 	// If safeOutputs is configured but no permissions were accumulated (all handlers staged),
 	// return explicit empty permissions so the compiled safe_outputs job renders
 	// "permissions: {}" rather than omitting the block and inheriting workflow-level permissions.
diff --git a/pkg/workflow/safe_outputs_permissions_test.go b/pkg/workflow/safe_outputs_permissions_test.go
index 906a8b6b279..c62ce60517d 100644
--- a/pkg/workflow/safe_outputs_permissions_test.go
+++ b/pkg/workflow/safe_outputs_permissions_test.go
@@ -28,8 +28,7 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
-				PermissionContents: PermissionRead,
-				PermissionIssues:   PermissionWrite,
+				PermissionIssues: PermissionWrite,
 			},
 		},
 		{
@@ -40,7 +39,6 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
-				PermissionContents:    PermissionRead,
 				PermissionIssues:      PermissionWrite,
 				PermissionDiscussions: PermissionWrite,
 			},
@@ -53,7 +51,6 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
-				PermissionContents:    PermissionRead,
 				PermissionDiscussions: PermissionWrite,
 			},
 		},
@@ -67,7 +64,6 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
-				PermissionContents:    PermissionRead,
 				PermissionDiscussions: PermissionWrite,
 			},
 		},
@@ -79,7 +75,6 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
-				PermissionContents:     PermissionRead,
 				PermissionIssues:       PermissionWrite,
 				PermissionPullRequests: PermissionWrite,
 			},
@@ -93,7 +88,6 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
-				PermissionContents:     PermissionRead,
 				PermissionIssues:       PermissionWrite,
 				PermissionPullRequests: PermissionWrite,
 				PermissionDiscussions:  PermissionWrite,
@@ -108,7 +102,6 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
-				PermissionContents:     PermissionRead,
 				PermissionIssues:       PermissionWrite,
 				PermissionPullRequests: PermissionWrite,
 			},
@@ -122,8 +115,7 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
-				PermissionContents: PermissionRead,
-				PermissionIssues:   PermissionWrite,
+				PermissionIssues: PermissionWrite,
 			},
 		},
 		{
@@ -135,7 +127,6 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
-				PermissionContents:     PermissionRead,
 				PermissionPullRequests: PermissionWrite,
 			},
 		},
@@ -147,7 +138,6 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
-				PermissionContents:    PermissionRead,
 				PermissionIssues:      PermissionWrite,
 				PermissionDiscussions: PermissionWrite,
 			},
@@ -161,8 +151,7 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
-				PermissionContents: PermissionRead,
-				PermissionIssues:   PermissionWrite,
+				PermissionIssues: PermissionWrite,
 			},
 		},
 		{
@@ -173,7 +162,6 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
-				PermissionContents:     PermissionRead,
 				PermissionIssues:       PermissionWrite,
 				PermissionPullRequests: PermissionWrite,
 			},
@@ -186,7 +174,6 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
-				PermissionContents:     PermissionRead,
 				PermissionIssues:       PermissionWrite,
 				PermissionPullRequests: PermissionWrite,
 			},
@@ -199,8 +186,7 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
-				PermissionContents: PermissionRead,
-				PermissionIssues:   PermissionWrite,
+				PermissionIssues: PermissionWrite,
 			},
 		},
 		{
@@ -211,12 +197,11 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
-				PermissionContents:     PermissionRead,
 				PermissionPullRequests: PermissionWrite,
 			},
 		},
 		{
-			name: "update-pull-request without update-branch requires contents read",
+			name: "update-pull-request without update-branch only requires pull-requests write",
 			safeOutputs: &SafeOutputsConfig{
 				UpdatePullRequests: &UpdatePullRequestsConfig{
 					UpdateEntityConfig: UpdateEntityConfig{
@@ -225,7 +210,6 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
-				PermissionContents:     PermissionRead,
 				PermissionPullRequests: PermissionWrite,
 			},
 		},
@@ -337,7 +321,6 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
-				PermissionContents:     PermissionRead,
 				PermissionIssues:       PermissionWrite,
 				PermissionPullRequests: PermissionWrite,
 			},
@@ -356,22 +339,19 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
-				PermissionContents:     PermissionRead,
 				PermissionIssues:       PermissionWrite,
 				PermissionPullRequests: PermissionWrite,
 				PermissionDiscussions:  PermissionWrite,
 			},
 		},
 		{
-			name: "upload-asset requires contents read",
+			name: "upload-asset requires no permissions in safe_outputs job",
 			safeOutputs: &SafeOutputsConfig{
 				UploadAssets: &UploadAssetsConfig{
 					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
 				},
 			},
-			expected: map[PermissionScope]PermissionLevel{
-				PermissionContents: PermissionRead,
-			},
+			expected: map[PermissionScope]PermissionLevel{},
 		},
 		{
 			name: "create-code-scanning-alert requires security-events write",
@@ -381,7 +361,6 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
-				PermissionContents:       PermissionRead,
 				PermissionSecurityEvents: PermissionWrite,
 			},
 		},
@@ -393,7 +372,6 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
-				PermissionContents:       PermissionRead,
 				PermissionSecurityEvents: PermissionWrite,
 				PermissionActions:        PermissionRead,
 			},
@@ -417,7 +395,6 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
-				PermissionContents:         PermissionRead,
 				PermissionOrganizationProj: PermissionWrite,
 				PermissionIssues:           PermissionRead,
 			},
@@ -430,7 +407,6 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
-				PermissionContents:         PermissionRead,
 				PermissionOrganizationProj: PermissionWrite,
 				PermissionIssues:           PermissionRead,
 			},
@@ -452,12 +428,82 @@ func TestComputePermissionsForSafeOutputs(t *testing.T) {
 				},
 			},
 			expected: map[PermissionScope]PermissionLevel{
-				PermissionContents:         PermissionRead,
 				PermissionIssues:           PermissionWrite,
 				PermissionPullRequests:     PermissionWrite,
 				PermissionOrganizationProj: PermissionWrite,
 			},
 		},
+		{
+			name: "create-project-status-update requires only organization-projects write",
+			safeOutputs: &SafeOutputsConfig{
+				CreateProjectStatusUpdates: &CreateProjectStatusUpdateConfig{
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
+				},
+			},
+			expected: map[PermissionScope]PermissionLevel{
+				PermissionOrganizationProj: PermissionWrite,
+			},
+		},
+		{
+			name: "create-check-run without target requires only checks write",
+			safeOutputs: &SafeOutputsConfig{
+				CreateCheckRun: &CreateCheckRunConfig{
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
+				},
+			},
+			expected: map[PermissionScope]PermissionLevel{
+				PermissionChecks: PermissionWrite,
+			},
+		},
+		{
+			name: "create-check-run with target requires checks write and pull-requests read",
+			safeOutputs: &SafeOutputsConfig{
+				CreateCheckRun: &CreateCheckRunConfig{
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
+					Target:               "triggering",
+				},
+			},
+			expected: map[PermissionScope]PermissionLevel{
+				PermissionChecks:       PermissionWrite,
+				PermissionPullRequests: PermissionRead,
+			},
+		},
+		{
+			name: "merge-pull-request requires contents write and pull-requests write",
+			safeOutputs: &SafeOutputsConfig{
+				MergePullRequest: &MergePullRequestConfig{
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
+				},
+			},
+			expected: map[PermissionScope]PermissionLevel{
+				PermissionContents:     PermissionWrite,
+				PermissionPullRequests: PermissionWrite,
+			},
+		},
+		{
+			name: "update-release requires only contents write",
+			safeOutputs: &SafeOutputsConfig{
+				UpdateRelease: &UpdateReleaseConfig{
+					UpdateEntityConfig: UpdateEntityConfig{
+						BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
+					},
+				},
+			},
+			expected: map[PermissionScope]PermissionLevel{
+				PermissionContents: PermissionWrite,
+			},
+		},
+		{
+			name: "create-agent-session requires only issues write",
+			safeOutputs: &SafeOutputsConfig{
+				CreateAgentSessions: &CreateAgentSessionConfig{
+					BaseSafeOutputConfig: BaseSafeOutputConfig{Max: strPtr("1")},
+				},
+			},
+			expected: map[PermissionScope]PermissionLevel{
+				PermissionIssues: PermissionWrite,
+			},
+		},
 	}
 
 	for _, tt := range tests {
@@ -675,6 +721,67 @@ func TestComputePermissionsForSafeOutputs_IDToken(t *testing.T) {
 	}
 }
 
+func TestComputePermissionsForSafeOutputs_Checkout(t *testing.T) {
+	tests := []struct {
+		name           string
+		safeOutputs    *SafeOutputsConfig
+		expectContents bool
+	}{
+		{
+			name: "no steps - no contents permission",
+			safeOutputs: &SafeOutputsConfig{
+				CreateIssues: &CreateIssuesConfig{},
+			},
+			expectContents: false,
+		},
+		{
+			name: "step with actions/checkout - auto-detects contents: read",
+			safeOutputs: &SafeOutputsConfig{
+				CreateIssues: &CreateIssuesConfig{},
+				Steps: []any{
+					map[string]any{"uses": "actions/checkout@v4"},
+				},
+			},
+			expectContents: true,
+		},
+		{
+			name: "step with actions/checkout versioned pin - auto-detects contents: read",
+			safeOutputs: &SafeOutputsConfig{
+				CreateIssues: &CreateIssuesConfig{},
+				Steps: []any{
+					map[string]any{"uses": "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683"},
+				},
+			},
+			expectContents: true,
+		},
+		{
+			name: "step without checkout - no contents permission",
+			safeOutputs: &SafeOutputsConfig{
+				CreateIssues: &CreateIssuesConfig{},
+				Steps: []any{
+					map[string]any{"run": "echo hello"},
+				},
+			},
+			expectContents: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			permissions := ComputePermissionsForSafeOutputs(tt.safeOutputs)
+			require.NotNil(t, permissions, "Permissions should not be nil")
+
+			level, exists := permissions.Get(PermissionContents)
+			if tt.expectContents {
+				assert.True(t, exists, "Expected contents permission to be set")
+				assert.Equal(t, PermissionRead, level, "Expected contents: read")
+			} else {
+				assert.False(t, exists, "Expected contents permission NOT to be set")
+			}
+		})
+	}
+}
+
 func TestComputePermissionsForSafeOutputs_Staged(t *testing.T) {
 	tests := []struct {
 		name        string
@@ -701,7 +808,6 @@ func TestComputePermissionsForSafeOutputs_Staged(t *testing.T) {
 			},
 			// create-issue is staged so it contributes nothing; add-labels is not staged
 			expected: map[PermissionScope]PermissionLevel{
-				PermissionContents:     PermissionRead,
 				PermissionIssues:       PermissionWrite,
 				PermissionPullRequests: PermissionWrite,
 			},
@@ -740,8 +846,7 @@ func TestComputePermissionsForSafeOutputs_Staged(t *testing.T) {
 			},
 			// create-pull-request is staged; close-issue is not
 			expected: map[PermissionScope]PermissionLevel{
-				PermissionContents: PermissionRead,
-				PermissionIssues:   PermissionWrite,
+				PermissionIssues: PermissionWrite,
 			},
 		},
 		{
@@ -771,7 +876,6 @@ func TestComputePermissionsForSafeOutputs_Staged(t *testing.T) {
 			},
 			// submit-pull-request-review is not staged, so PR write permissions are added
 			expected: map[PermissionScope]PermissionLevel{
-				PermissionContents:     PermissionRead,
 				PermissionPullRequests: PermissionWrite,
 			},
 		},