From 2d856ee2a29ee5c7cadbba6dfe610ed66e72e25e Mon Sep 17 00:00:00 2001 From: pdfinn Date: Mon, 5 Oct 2026 15:54:02 +0800 Subject: [PATCH] ci: least-privilege GITHUB_TOKEN permissions (code-scanning fixes) Resolve open code-scanning alerts (actions/missing-workflow-permissions and related) by giving workflows an explicit least-privilege token. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 3 +++ .github/workflows/go.yml | 3 +++ 2 files changed, 6 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f820258..0d3a55f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -4,6 +4,9 @@ on: push: pull_request: +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml index 179f9e2..23bdc66 100644 --- a/.github/workflows/go.yml +++ b/.github/workflows/go.yml @@ -9,6 +9,9 @@ on: pull_request: branches: [ "main" ] +permissions: + contents: read + jobs: build: