From 13abcdeb69444dd862fec79f5b6d5bd3980c918f Mon Sep 17 00:00:00 2001 From: htjulia Date: Tue, 13 Oct 2026 13:36:33 +0900 Subject: [PATCH] chore(ci): pin the workflow token to read-only contents CodeQL flagged all four CI jobs with missing-workflow-permissions: without a permissions block they take whatever token scope the repository default grants. The default is read today, but that is a setting outside the repo; declaring contents: read in the workflow keeps the token read-only even if the default is changed later. Co-Authored-By: htjulia --- .github/workflows/ci.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 29155d6..7c5350f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,6 +16,12 @@ concurrency: group: ci-${{ github.ref }} cancel-in-progress: true +# Every job only reads the checkout and runs npm, so the token gets read access to +# contents and nothing else, whatever the repository default is. Without this the +# jobs inherit that default, which can include write access. +permissions: + contents: read + jobs: lint: runs-on: ubuntu-latest