From bd16b4ed4acf15b530466044283857381c815926 Mon Sep 17 00:00:00 2001 From: Zohar Zilberman Date: Thu, 28 May 2026 20:29:46 +0300 Subject: [PATCH] Restrict GITHUB_TOKEN to contents:read in CI workflows Addresses CodeQL findings on the test and release workflows (PR #12 review): neither declared an explicit permissions block, so GITHUB_TOKEN defaulted to broader access than needed. The workflows only need to checkout the repo; cargo publish uses CARGO_REGISTRY_TOKEN, not the default token. https://claude.ai/code/session_01BzqC31UjuAPBM2H7hfzdju --- .github/workflows/release.yml | 3 +++ .github/workflows/test.yml | 3 +++ 2 files changed, 6 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 95dd91e..c645412 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -5,6 +5,9 @@ on: tags: - v** +permissions: + contents: read + jobs: test: uses: ./.github/workflows/test.yml diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 7d442fd..575dc8a 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -4,6 +4,9 @@ on: pull_request: workflow_call: +permissions: + contents: read + jobs: test: name: 🧪 Test (${{ matrix.profile }})