Skip to content

ci: least-privilege workflow token permissions - #80

Closed
fastrevmd-lab wants to merge 1 commit into
mainfrom
ci/workflow-permissions
Closed

fastrevmd-lab wants to merge 1 commit into
mainfrom
ci/workflow-permissions

Conversation

@fastrevmd-lab

@fastrevmd-lab fastrevmd-lab commented Oct 16, 2026 •

Copy link
Copy Markdown
Member

Resolves code-scanning alerts actions/missing-workflow-permissions in .github/workflows/ci.yml: #1 :26, #2 :42, #3 :81, #4 :126 (jobs lint, test, sql-contract, vector-test).

Permissions granted: top-level contents: read only. No job pushes, comments, signs or uses OIDC; no reusable workflows are called (the conformance step is a composite action needing no token scopes). No behaviour change.

🤖 Generated with Claude Code

Paperclip: MEC-3083

Add top-level permissions: contents: read to ci.yml.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@fastrevmd-lab

Copy link
Copy Markdown
Member Author

Superseded by #81.

@fastrevmd-lab
fastrevmd-lab deleted the ci/workflow-permissions branch October 16, 2026 16:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant