From d273506b33525be0695404e9ac7b99fdaa5cd3e4 Mon Sep 17 00:00:00 2001 From: Arpit Jain Date: Thu, 21 May 2026 11:01:12 +0900 Subject: [PATCH] ci: cap GITHUB_TOKEN to contents: read The ci workflow runs validation; no GitHub API writes from the workflow. contents: read at workflow level is sufficient. Post-CVE-2025-30066 hardening shape. yaml.safe_load validated. Signed-off-by: Arpit Jain --- .github/workflows/ci.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index abbd4b1..66efe2b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -5,6 +5,9 @@ on: pull_request: types: [ opened, reopened, synchronize, edited ] +permissions: + contents: read + jobs: main: runs-on: ubuntu-latest