From d6d06145664a100c5153a04702c7abf883ef64ae Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 13:32:00 +0200 Subject: [PATCH 1/6] CI: add least-privilege permissions to GitHub Actions workflows Add explicit workflow-level permissions blocks to resolve CodeQL actions/missing-workflow-permissions alerts. Scopes are derived from workflow operations (git push, artifact upload, Danger, release lanes). Refs: APPSEC-164 --- .github/workflows/docs.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 27784f70..a54d66f3 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -10,6 +10,11 @@ concurrency: group: ${{ github.ref }}-${{ github.workflow }} cancel-in-progress: true +permissions: + actions: write + contents: read + pull-requests: read + jobs: build-docs: runs-on: ubuntu-latest From 76776f0d5214731fc7a773c2d52887ddfc483440 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 13:32:01 +0200 Subject: [PATCH 2/6] CI: add least-privilege permissions to GitHub Actions workflows Add explicit workflow-level permissions blocks to resolve CodeQL actions/missing-workflow-permissions alerts. Scopes are derived from workflow operations (git push, artifact upload, Danger, release lanes). Refs: APPSEC-164 --- .github/workflows/lint.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 027187ba..fc53937e 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -6,6 +6,9 @@ concurrency: group: ${{ github.ref }}-${{ github.workflow }} cancel-in-progress: true +permissions: + contents: read + jobs: lint: runs-on: ubuntu-latest From 0685844d53b04b27a59a127c2f62dfc5be690b9e Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 13:32:02 +0200 Subject: [PATCH 3/6] CI: add least-privilege permissions to GitHub Actions workflows Add explicit workflow-level permissions blocks to resolve CodeQL actions/missing-workflow-permissions alerts. Scopes are derived from workflow operations (git push, artifact upload, Danger, release lanes). Refs: APPSEC-164 --- .github/workflows/size-limit.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/size-limit.yml b/.github/workflows/size-limit.yml index 3e79c159..d356ad73 100644 --- a/.github/workflows/size-limit.yml +++ b/.github/workflows/size-limit.yml @@ -13,6 +13,10 @@ concurrency: group: ${{ github.ref }}-${{ github.workflow }} cancel-in-progress: true +permissions: + contents: read + pull-requests: read + jobs: size: runs-on: ubuntu-latest From f29f98606248b04efa401b1e611b650356975fc0 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 13:32:04 +0200 Subject: [PATCH 4/6] CI: add least-privilege permissions to GitHub Actions workflows Add explicit workflow-level permissions blocks to resolve CodeQL actions/missing-workflow-permissions alerts. Scopes are derived from workflow operations (git push, artifact upload, Danger, release lanes). Refs: APPSEC-164 --- .github/workflows/unit.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/unit.yml b/.github/workflows/unit.yml index dad5fff1..bc6a8322 100644 --- a/.github/workflows/unit.yml +++ b/.github/workflows/unit.yml @@ -6,6 +6,9 @@ concurrency: group: ${{ github.ref }}-${{ github.workflow }} cancel-in-progress: true +permissions: + contents: read + jobs: unit: runs-on: ubuntu-latest From b7ae956e8b73d73a9cdb4005fb61c758f745c942 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Fri, 10 Jul 2026 13:40:05 +0200 Subject: [PATCH 5/6] CI: upgrade actions/cache from v2 to v4 GitHub now auto-fails workflows using deprecated actions/cache v1/v2. --- .github/actions/setup-node/action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/actions/setup-node/action.yml b/.github/actions/setup-node/action.yml index 69c865e6..2b29afe3 100644 --- a/.github/actions/setup-node/action.yml +++ b/.github/actions/setup-node/action.yml @@ -14,7 +14,7 @@ runs: with: node-version: ${{ inputs.node-version }} - name: Cache Dependencies - uses: actions/cache@v2 + uses: actions/cache@v4 with: path: ./node_modules key: ${{ runner.os }}-${{ inputs.node-version }}-modules-${{ hashFiles('**/yarn.lock') }} From d709679eee149404507e950735004301e9c57045 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Fri, 10 Jul 2026 15:22:58 +0200 Subject: [PATCH 6/6] CI: upgrade actions/cache from v2 to v4 Co-authored-by: Cursor --- .github/workflows/docs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index a54d66f3..49a6ea43 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -22,7 +22,7 @@ jobs: - uses: actions/checkout@v2 - uses: ./.github/actions/setup-node - name: Cache .docz folder - uses: actions/cache@v2 + uses: actions/cache@v4 with: path: ./.docz key: docz-${{ matrix.node }}-gatsby-v1-${{ github.run_id }}