From dcf93ceb2ded7d5781097ef9436ba44a8ece7316 Mon Sep 17 00:00:00 2001
From: Olivier Vernin <olivier@vernin.me>
Date: Thu, 10 Sep 2026 20:50:53 +0200
Subject: [PATCH] fix: set github_token for zizmor

Signed-off-by: Olivier Vernin <olivier@vernin.me>
---
 .github/workflows/updatecli.yaml        | 6 ++++--
 .github/workflows/updatecli_test.yaml   | 8 ++++----
 .github/workflows/updatecli_update.yaml | 8 ++++----
 3 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/updatecli.yaml b/.github/workflows/updatecli.yaml
index c7a423a..8eaf4d6 100644
--- a/.github/workflows/updatecli.yaml
+++ b/.github/workflows/updatecli.yaml
@@ -9,6 +9,8 @@ permissions: {}
 jobs:
   updatecli:
     runs-on: ubuntu-latest
+    permissions:
+      contents: "read"
     steps:
       - name: "Checkout"
         uses: "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1" # v7.0.1
@@ -40,7 +42,7 @@ jobs:
           UPDATECLI_UDASH_API_URL: ${{ secrets.UPDATECLI_UDASH_API_URL }}
           UPDATECLI_UDASH_ACCESS_TOKEN: ${{ secrets.UPDATECLI_UDASH_ACCESS_TOKEN }}
           UPDATECLI_UDASH_URL: ${{ secrets.UPDATECLI_UDASH_URL }}
-          ## The Github token seems to be needed by Zizmor
+          ## The Github token is needed by Zizmor
           # https://github.com/updatecli/policies/blob/main/updatecli/policies/zizmor/githubaction/scaffold/updatecli.d/default.yaml#L106
           # Adding for now just for testing
-          GITHUB_TOKEN: ""
+          GITHUB_TOKEN: " ${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/updatecli_test.yaml b/.github/workflows/updatecli_test.yaml
index a9cdd9d..fd37ac5 100644
--- a/.github/workflows/updatecli_test.yaml
+++ b/.github/workflows/updatecli_test.yaml
@@ -7,6 +7,8 @@ permissions:
 jobs:
   updatecli:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: "Checkout"
         uses: "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1" # v7.0.1
@@ -35,7 +37,5 @@ jobs:
           # This step is executed in untrusted context. We use a GitHub token with minimal permissions.
           UPDATECLI_GITHUB_USERNAME: ${{ github.actor }}
           UPDATECLI_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          ## The Github token seems to be needed by Zizmor
-          # https://github.com/updatecli/policies/blob/main/updatecli/policies/zizmor/githubaction/scaffold/updatecli.d/default.yaml#L106
-          # Adding for now just for testing
-          GITHUB_TOKEN: ""
+          ## The Github token is needed by Zizmor
+          GITHUB_TOKEN: " ${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/updatecli_update.yaml b/.github/workflows/updatecli_update.yaml
index 18c9883..be52850 100644
--- a/.github/workflows/updatecli_update.yaml
+++ b/.github/workflows/updatecli_update.yaml
@@ -21,6 +21,8 @@ jobs:
             apply_args: "--labels=monitor:active"
           - target_name: "existing pipelines"
             apply_args: "--existing-only=true"
+    permissions:
+      contents: read
     steps:
       - name: "Checkout"
         uses: "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1" # v7.0.1
@@ -52,7 +54,5 @@ jobs:
           UPDATECLI_UDASH_API_URL: ${{ secrets.UPDATECLI_UDASH_API_URL }}
           UPDATECLI_UDASH_ACCESS_TOKEN: ${{ secrets.UPDATECLI_UDASH_ACCESS_TOKEN }}
           UPDATECLI_UDASH_URL: ${{ secrets.UPDATECLI_UDASH_URL }}
-          ## The Github token seems to be needed by Zizmor
-          # https://github.com/updatecli/policies/blob/main/updatecli/policies/zizmor/githubaction/scaffold/updatecli.d/default.yaml#L106
-          # Adding for now just for testing
-          GITHUB_TOKEN: ""
+          ## The Github token is needed by Zizmor
+          GITHUB_TOKEN: " ${{ secrets.GITHUB_TOKEN }}"