extensions:
  - addsTo:
      pack: codeql/actions-all
      extensible: actionsPermissionsDataModel
    data:
      - ["actions/checkout", "contents: read"]
      - ["actions/setup-node", "contents: read"]
      - ["actions/setup-python", "contents: read"]
      - ["actions/setup-java", "contents: read"]
      - ["actions/setup-go", "contents: read"]
      - ["actions/setup-dotnet", "contents: read"]
      - ["actions/labeler", "contents: read"]
      - ["actions/labeler", "pull-requests: write"]
      - ["actions/attest", "id-token: write"]
      - ["actions/attest", "attestations: write"]
      # No permissions needed for actions/add-to-project
      - ["actions/dependency-review-action", "contents: read"]
      - ["actions/attest-sbom", "id-token: write"]
      - ["actions/attest-sbom", "attestations: write"]
      - ["actions/stale", "contents: write"]
      - ["actions/stale", "issues: write"]
      - ["actions/stale", "pull-requests: write"]
      - ["actions/attest-build-provenance", "id-token: write"]
      - ["actions/attest-build-provenance", "attestations: write"]
      - ["actions/deploy-pages", "pages: write"]
      - ["actions/deploy-pages", "id-token: write"]
      - ["actions/delete-package-versions", "packages: write"]
      - ["actions/jekyll-build-pages", "contents: read"]
      - ["actions/jekyll-build-pages", "pages: write"]
      - ["actions/jekyll-build-pages", "id-token: write"]
      - ["actions/publish-action", "contents: write"]
      - ["actions/versions-package-tools", "contents: read"]
      - ["actions/versions-package-tools", "actions: read"]
      - ["actions/reusable-workflows", "contents: read"]
      - ["actions/reusable-workflows", "actions: read"]
      - ["actions/ai-inference", "contents: read"]
      - ["actions/ai-inference", "models: read"]
      # TODO: Add permissions for actions/download-artifact
      # TODO: Add permissions for actions/upload-artifact
      # No permissions needed for actions/upload-pages-artifact
      # TODO: Add permissions for actions/cache
      # No permissions needed for actions/configure-pages