From b86e2139e5c80c67a67dc5752215bbed3acb2c7b Mon Sep 17 00:00:00 2001
From: Prowler Bot <bot@prowler.com>
Date: Wed, 25 Jun 2025 10:27:43 +0200
Subject: [PATCH] chore(gha): add permissions on check-changelog workflow
 (#8102)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: César Arroba <19954079+cesararroba@users.noreply.github.com>
---
 .github/workflows/pull-request-check-changelog.yml | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/pull-request-check-changelog.yml b/.github/workflows/pull-request-check-changelog.yml
index 19fd59804b..d983c5ad35 100644
--- a/.github/workflows/pull-request-check-changelog.yml
+++ b/.github/workflows/pull-request-check-changelog.yml
@@ -2,17 +2,15 @@ name: Check Changelog
 
 on:
   pull_request:
-    types: [opened, synchronize, reopened]
-    paths:
-      - 'api/**'
-      - 'ui/**'
-      - 'prowler/**'
+    types: [opened, synchronize, reopened, labeled, unlabeled]
 
 jobs:
   check-changelog:
     if: contains(github.event.pull_request.labels.*.name, 'no-changelog') == false
     runs-on: ubuntu-latest
     permissions:
+      id-token: write
+      contents: read
       pull-requests: write
     env:
       MONITORED_FOLDERS: "api ui prowler"