Skip to content

ci: default GITHUB_TOKEN to contents: read - #67

Open
KofTwentyTwo wants to merge 1 commit into
developfrom
feature/security-findings-2026-10
Open

KofTwentyTwo wants to merge 1 commit into
developfrom
feature/security-findings-2026-10

Conversation

@KofTwentyTwo

Copy link
Copy Markdown
Member

Fixes #66

Adds workflow-level permissions: contents: read as the default for test, build-native and update-homebrew (which pushes with its own tap token). Jobs that already declare permissions (release, docker, update-scoop, update-aur) are unchanged.

Resolves code-scanning alerts #1-#3 (actions/missing-workflow-permissions). YAML validated.

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Build workflow jobs run with default GITHUB_TOKEN permissions

1 participant