From 506c392d241e6e142ac80899567f16819f110418 Mon Sep 17 00:00:00 2001 From: "Nabheet S. Sandhu" Date: Fri, 30 Oct 2026 22:19:57 -0600 Subject: [PATCH] ci(security): default the GITHUB_TOKEN to contents: read Clears the open CodeQL actions/missing-workflow-permissions alert on the `test` job. publish and prerelease declare their own job-level permissions (contents/id-token/pull-requests), which replace this workflow default, so their access is unchanged; `test` only checks out, installs and builds, which read-only covers. A new job now inherits read-only instead of the repository default. --- .github/workflows/ci.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8c55bfd..990bb81 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -28,6 +28,13 @@ on: merge_group: workflow_dispatch: +# Read-only GITHUB_TOKEN for every job that does not say otherwise (publish +# and prerelease declare their own blocks, which replace this one). Keeps a +# future job from silently inheriting write access, and satisfies CodeQL +# actions/missing-workflow-permissions. +permissions: + contents: read + jobs: test: runs-on: ubuntu-latest