From ac50ae7baee7b66baf7b70757b0d23360dcb3b2e Mon Sep 17 00:00:00 2001 From: Devid HW Date: Tue, 25 Aug 2026 10:44:44 +0700 Subject: [PATCH] ci: declare explicit least-privilege permissions (fix Token-Permissions) --- .github/workflows/codeql.yml | 1 - .github/workflows/dependency-review.yml | 1 + .github/workflows/scorecard.yml | 3 ++- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index d88488e..8407bb7 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -10,7 +10,6 @@ on: workflow_dispatch: permissions: - security-events: write contents: read jobs: diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 3bab655..f0f7663 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -4,6 +4,7 @@ on: [pull_request] permissions: contents: read + pull-requests: read jobs: dependency-review: diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index e0d9082..b39cd46 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -6,7 +6,8 @@ on: push: branches: [master] -permissions: read-all +permissions: + contents: read jobs: analysis: