From 6a870f4baeb97579dd4c66a9d553ac1834bf0bd9 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Sat, 18 Apr 2026 01:54:12 +0000 Subject: [PATCH 1/2] fix: add explicit empty permissions to deploy-railway.yml Add permissions: {} at the workflow level to explicitly deny all GitHub token permissions, following the principle of least privilege. This workflow only needs RAILWAY_TOKEN and has no use for GitHub token access. Fixes the CodeQL actions/missing-workflow-permissions alert #27. Co-authored-by: Michael Sukkarieh --- .github/workflows/deploy-railway.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/deploy-railway.yml b/.github/workflows/deploy-railway.yml index 2c3edc1d2..57bd75650 100644 --- a/.github/workflows/deploy-railway.yml +++ b/.github/workflows/deploy-railway.yml @@ -1,5 +1,7 @@ name: Deploy to Railway +permissions: {} + on: workflow_run: workflows: ["Release Sourcebot (Development)"] From cdf124a7c9610e66f08fc6dc76e7ae93bb95395a Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Sat, 18 Apr 2026 01:54:49 +0000 Subject: [PATCH 2/2] docs: add CHANGELOG entry for deploy-railway permissions fix Co-authored-by: Michael Sukkarieh --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 454eebecd..7f222c2c7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed - Fixed revision selection so the 64-revision cap prefers the newest matching branches and tags instead of pruning by ref-name order. [#1122](https://github.com/sourcebot-dev/sourcebot/pull/1122) - Fixed infinite pagination loop in Gitea/Forgejo when an API token can only see a subset of org repos (the `x-total-count` header reports org total while token returns fewer items). [#1130](https://github.com/sourcebot-dev/sourcebot/pull/1130) +- Fixed CodeQL missing-workflow-permissions alert by adding explicit empty permissions to `deploy-railway.yml`. [#1132](https://github.com/sourcebot-dev/sourcebot/pull/1132) ## [4.16.11] - 2026-04-17