From 9cabdcfcdba5dc34fdd47ff324da3fffd9040332 Mon Sep 17 00:00:00 2001 From: "Joseph T. French" Date: Fri, 21 Aug 2026 21:38:33 -0500 Subject: [PATCH] chore(ci): give every workflow job explicit permissions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three jobs ran on the repository's default token scope because they declared no `permissions:` block, which code scanning flags as actions/missing-workflow-permissions. Each now gets only what it uses: - test: contents: read — checkout, then local tooling only - create-release: contents: write — pushes the version commit to main and the release branch; it makes no gh API calls, so nothing beyond contents is needed - create-summary: contents: read — writes $GITHUB_STEP_SUMMARY and nothing else publish.yml already declared contents: read plus id-token: write for PyPI trusted publishing and is deliberately untouched — narrowing it would break the publish. --- .github/workflows/create-release.yml | 4 ++++ .github/workflows/test.yml | 2 ++ 2 files changed, 6 insertions(+) diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml index 67c4eb7..15abf24 100644 --- a/.github/workflows/create-release.yml +++ b/.github/workflows/create-release.yml @@ -16,6 +16,8 @@ on: jobs: create-release: runs-on: ubuntu-latest + permissions: + contents: write outputs: new_version: ${{ steps.new-version.outputs.new_version }} branch_name: ${{ steps.new-version.outputs.branch_name }} @@ -136,6 +138,8 @@ jobs: needs: [create-release, create-tag] if: always() runs-on: ubuntu-latest + permissions: + contents: read steps: - name: Create summary run: | diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 0fa137c..c100817 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -9,6 +9,8 @@ on: jobs: test: runs-on: ubuntu-latest + permissions: + contents: read timeout-minutes: 5 steps: - name: Checkout