From e9efb280de75dd4920536fb3b0c6c8f852b0f847 Mon Sep 17 00:00:00 2001
From: Bart Louwers <bart@emeel.net>
Date: Thu, 19 Oct 2023 22:49:11 +0200
Subject: [PATCH] Update permissions linux-ci (#1784)

---
 .github/workflows/linux-ci.yml  |  5 ++++-
 .github/workflows/pr-bloaty.yml | 12 ++++++------
 2 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/linux-ci.yml b/.github/workflows/linux-ci.yml
index 8e08f8494..a038ce0c8 100644
--- a/.github/workflows/linux-ci.yml
+++ b/.github/workflows/linux-ci.yml
@@ -16,7 +16,10 @@ concurrency:
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
 permissions:
-  id-token: write      # This is required for requesting the AWS JWT
+  id-token: write         # needed for AWS
+  actions: read           # needed for CodeQL
+  contents: read          # needed for CodeQL
+  security-events: write  # needed for CodeQL
 
 jobs:
   pre_job:
diff --git a/.github/workflows/pr-bloaty.yml b/.github/workflows/pr-bloaty.yml
index b42063d52..e659a0b73 100644
--- a/.github/workflows/pr-bloaty.yml
+++ b/.github/workflows/pr-bloaty.yml
@@ -44,6 +44,12 @@ jobs:
           cmakeVersion: latest
           ninjaVersion: latest
 
+      - name: Cache Bloaty
+        uses: actions/cache@v3
+        with:
+          path: bloaty/build/bloaty
+          key: bloaty-${{ env.bloaty_sha }}
+
       # because Google is not making a release...
       # https://github.com/google/bloaty/issues/334
       - name: Compile Bloaty
@@ -54,12 +60,6 @@ jobs:
           cmake -B build -G Ninja -S .
           cmake --build build
 
-      - name: Cache Bloaty
-        uses: actions/cache@v3
-        with:
-          path: bloaty/build/bloaty
-          key: bloaty-${{ env.bloaty_sha }}
-
       - name: Run Bloaty McBloatface on main
         run: bloaty/build/bloaty mbgl-render -- mbgl-render-main -n 0 -s vm -d compileunits > tlus_diff_main.txt