April 2026: CI permissions hardening across three repositories, with explicit top-level and job-level permissions, improving reliability and security posture. Key changes include: Prometheus: fix to GitHub Actions workflow permissions; Spiffe: explicit permissions for CI workflows; Helm: top-level permissions for OpenSSF alignment. Outcomes include fewer CI failures due to permissions and stronger security/compliance posture.

Month: 2026-03 | Dapr/dapr CI Security Hardening: Implemented GitHub Workflow Security Hardening to restrict token permissions in CI workflows. Key changes include adding top-level permissions (contents: read) to backport.yaml and sync-release-branch.yaml and updating the backport workflow to an empty permissions object, aligning with least-privilege security. Impact: reduces CI blast radius, improves OpenSSF Scorecard Token-Permissions rating, and strengthens overall security posture with minimal disruption to release processes. Technologies/skills: GitHub Actions, YAML workflow configuration, token permission scoping, security best practices, cross-team collaboration.