From eee30907af7792fcde3555e8efdc44f9c1bf0d38 Mon Sep 17 00:00:00 2001
From: Peter Matkovski <peter.matkovski@getstream.io>
Date: Mon, 24 Aug 2026 16:59:20 +0200
Subject: [PATCH 1/2] ci: add least-privilege workflow permissions

---
 .github/workflows/ci.yml               | 3 +++
 .github/workflows/initiate_release.yml | 4 ++++
 .github/workflows/release.yml          | 5 ++++-
 .github/workflows/reviewdog.yml        | 6 +++++-
 4 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 94e6532..af2bb39 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/initiate_release.yml b/.github/workflows/initiate_release.yml
index c027b01..8f8e82d 100644
--- a/.github/workflows/initiate_release.yml
+++ b/.github/workflows/initiate_release.yml
@@ -7,6 +7,10 @@ on:
         description: "The new version number with 'v' prefix. Example: v1.40.1"
         required: true
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   init_release:
     name: 🚀 Create release PR
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 39111fc..3605579 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,6 +7,9 @@ on:
       - master
       - main
 
+permissions:
+  contents: write
+
 jobs:
   Release:
     name: 🚀 Release
@@ -37,4 +40,4 @@ jobs:
         with:
           body: ${{ env.CHANGELOG }}
           tag: ${{ env.VERSION }}
-          token: ${{ secrets.GITHUB_TOKEN }}
\ No newline at end of file
+          token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/reviewdog.yml b/.github/workflows/reviewdog.yml
index 82dfffc..2b698b6 100644
--- a/.github/workflows/reviewdog.yml
+++ b/.github/workflows/reviewdog.yml
@@ -6,6 +6,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   rubocop:
     name: 🐶 Reviewdog
@@ -22,4 +26,4 @@ jobs:
         uses: reviewdog/action-rubocop@v2
         with:
           rubocop_version: gemfile
-          reporter: github-pr-review
\ No newline at end of file
+          reporter: github-pr-review

From 0bb888ddfcbc652ac85b74b6e82e186607099858 Mon Sep 17 00:00:00 2001
From: Peter Matkovski <peter.matkovski@getstream.io>
Date: Mon, 24 Aug 2026 17:11:13 +0200
Subject: [PATCH 2/2] ci: preserve signer API during lint

---
 .rubocop.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.rubocop.yml b/.rubocop.yml
index 1fb395e..7e14e6d 100644
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -42,6 +42,8 @@ Style/DoubleCopDisableDirective:
   Enabled: false
 Style/FrozenStringLiteralComment:
   Enabled: false
+Style/OptionalArguments:
+  Enabled: false
 
 Gemspec/RequireMFA:
   Enabled: false