ci: restrict workflow token to contents: read #2

2026-10-16T21:10:57Z

KofTwentyTwo commented

2026-10-16 21:10:57 +00:00

(Migrated from github.com)

Fixes #1

Adds workflow-level permissions: contents: read (lint and test jobs only read the repository). Resolves code-scanning alerts #1 and #2. Alert #3 (py/clear-text-storage-sensitive-data) was dismissed as a false positive: the report writes a count of potential secrets, not a secret.

🤖 Generated with Claude Code

Fixes #1 Adds workflow-level `permissions: contents: read` (lint and test jobs only read the repository). Resolves code-scanning alerts #1 and #2. Alert #3 (`py/clear-text-storage-sensitive-data`) was dismissed as a false positive: the report writes a count of potential secrets, not a secret. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

You are not authorized to merge this pull request.

This pull request can be merged automatically.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin feature/security-findings-2026-10:feature/security-findings-2026-10

git checkout feature/security-findings-2026-10

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/Aestimare#2