From ac8c5b7c5a28c69aeda743a0642dfdbaec7b2a17 Mon Sep 17 00:00:00 2001 From: S'Bussiso Dube <80188685+Sbussiso@users.noreply.github.com> Date: Sat, 12 Sep 2026 23:18:06 -0700 Subject: [PATCH] Give the workflow tokens least privilege MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CodeQL`s actions/missing-workflow-permissions flagged every job here: with no permissions block a job inherits the repository default GITHUB_TOKEN scope, which is broader than anything in this repo needs. Checked before narrowing — no gh CLI calls, no git push, no package publish, and actions/upload-artifact uses the runtime token rather than a contents scope. contents: read is sufficient. Co-Authored-By: Claude Opus 5 --- .github/workflows/validate.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index a70fd9f..f9ab0e1 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -16,6 +16,18 @@ on: pull_request: branches: [master] +# Least-privilege token. Without this block a job gets whatever the +# repository's default GITHUB_TOKEN scope is, which is broader than +# anything here needs — CodeQL's actions/missing-workflow-permissions +# flagged every job in this file. Nothing here writes through the API: +# no `gh` calls, no git push, no package publish. Artifact upload does +# not need a contents scope either (it uses the runtime token). +# +# A job that genuinely needs more should declare it at the JOB level +# rather than widening this. +permissions: + contents: read + jobs: validate: name: Lint + import