From eb8704d3ce104665966a98a2f1be98723af11891 Mon Sep 17 00:00:00 2001
From: Bryce Lampe <bryce@pulumi.com>
Date: Wed, 1 Oct 2025 11:25:07 -0700
Subject: [PATCH] Fix command-dispatch token permissions

---
 .github/workflows/command-dispatch.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/command-dispatch.yml b/.github/workflows/command-dispatch.yml
index bf921f176cf5..d6c717e88bd7 100644
--- a/.github/workflows/command-dispatch.yml
+++ b/.github/workflows/command-dispatch.yml
@@ -11,8 +11,12 @@ env:
 
 jobs:
   command-dispatch-for-testing:
+    permissions:
+      contents: read
+      id-token: write # For ESC secrets.
     runs-on: ubuntu-latest
     name: command-dispatch-for-testing
+    if: ${{ github.event.issue.pull_request }}
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v4
@@ -34,4 +38,3 @@ jobs:
           permission: write
           issue-type: pull-request
           repository: pulumi/pulumi-azure-native
-    if: ${{ github.event.issue.pull_request }}