From a0b0fb53113930f052c572a2841d1e597fe03590 Mon Sep 17 00:00:00 2001 From: William Zujkowski Date: Wed, 17 Jun 2026 13:04:20 -0400 Subject: [PATCH] fix(ci): add least-privilege permissions block to CI workflow Resolves the CodeQL actions/missing-workflow-permissions alert. The CI workflow only checks out + builds + tests, so top-level contents:read is sufficient (least privilege; removes the default broad GITHUB_TOKEN scope). Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/ci.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0184525..1235c7f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,6 +6,9 @@ on: pull_request: branches: [main] +permissions: + contents: read + jobs: test: runs-on: ubuntu-latest