From e79a0414be995e0787a73b962be5ae105c92f6ab Mon Sep 17 00:00:00 2001
From: xopenwrt <xopenwrtnew@protonmail.com>
Date: Mon, 29 Jun 2026 21:57:48 +0800
Subject: [PATCH] add workflow permissions and concurrency

---
 .github/workflows/X-x86_64_X.yml                 |  8 ++++++++
 .github/workflows/X-x86_64_Y.yml                 |  8 ++++++++
 .github/workflows/X-x86_64_Z.yml                 |  8 ++++++++
 AI_CHANGELOG_WORKFLOW_PERMISSIONS_CONCURRENCY.md | 15 +++++++++++++++
 4 files changed, 39 insertions(+)
 create mode 100644 AI_CHANGELOG_WORKFLOW_PERMISSIONS_CONCURRENCY.md

diff --git a/.github/workflows/X-x86_64_X.yml b/.github/workflows/X-x86_64_X.yml
index eddb482..356187e 100644
--- a/.github/workflows/X-x86_64_X.yml
+++ b/.github/workflows/X-x86_64_X.yml
@@ -38,6 +38,14 @@ on:
   #watch:
   #  types: [started]
 
+permissions:
+  contents: write
+  actions: write
+
+concurrency:
+  group: openwrt-release-${{ github.ref }}
+  cancel-in-progress: false
+
 ### 环境变量设置
 env:
 # 编译时调用的 [.config] 文件名称
diff --git a/.github/workflows/X-x86_64_Y.yml b/.github/workflows/X-x86_64_Y.yml
index 05b908a..1318040 100644
--- a/.github/workflows/X-x86_64_Y.yml
+++ b/.github/workflows/X-x86_64_Y.yml
@@ -38,6 +38,14 @@ on:
   #watch:
   #  types: [started]
 
+permissions:
+  contents: write
+  actions: write
+
+concurrency:
+  group: openwrt-release-${{ github.ref }}
+  cancel-in-progress: false
+
 ### 环境变量设置
 env:
 # 编译时调用的 [.config] 文件名称
diff --git a/.github/workflows/X-x86_64_Z.yml b/.github/workflows/X-x86_64_Z.yml
index 163f58a..fc2b10c 100644
--- a/.github/workflows/X-x86_64_Z.yml
+++ b/.github/workflows/X-x86_64_Z.yml
@@ -38,6 +38,14 @@ on:
   #watch:
   #  types: [started]
 
+permissions:
+  contents: write
+  actions: write
+
+concurrency:
+  group: openwrt-release-${{ github.ref }}
+  cancel-in-progress: false
+
 ### 环境变量设置
 env:
 # 编译时调用的 [.config] 文件名称
diff --git a/AI_CHANGELOG_WORKFLOW_PERMISSIONS_CONCURRENCY.md b/AI_CHANGELOG_WORKFLOW_PERMISSIONS_CONCURRENCY.md
new file mode 100644
index 0000000..c8f8b83
--- /dev/null
+++ b/AI_CHANGELOG_WORKFLOW_PERMISSIONS_CONCURRENCY.md
@@ -0,0 +1,15 @@
+# AI Modification Log: Workflow Permissions And Concurrency
+
+Date: 2026-06-29
+
+## Change
+
+- Added explicit workflow permissions to X/Y/Z workflows:
+  - `contents: write`
+  - `actions: write`
+- Added workflow-level concurrency grouped by `openwrt-release-${{ github.ref }}`.
+- Set `cancel-in-progress: false` so existing long-running builds are not cancelled automatically.
+
+## Reason
+
+Release uploads need content write permission, and workflow-run cleanup needs actions write permission. Concurrency prevents multiple runs of the same workflow/ref from racing on shared release tags and dated upload paths.