ci: least-privilege GITHUB_TOKEN permissions #7

2026-10-16T21:12:56Z

KofTwentyTwo commented

2026-10-16 21:12:56 +00:00

(Migrated from github.com)

Fixes #6

Adds workflow-level permissions: contents: read to both workflows; create-tag (pushes the version tag), create-release and publish-package (upload release assets) get contents: write.

Resolves code-scanning alerts #1-#11 (actions/missing-workflow-permissions). YAML validated.

🤖 Generated with Claude Code

Fixes #6 Adds workflow-level `permissions: contents: read` to both workflows; `create-tag` (pushes the version tag), `create-release` and `publish-package` (upload release assets) get `contents: write`. Resolves code-scanning alerts #1-#11 (`actions/missing-workflow-permissions`). YAML validated. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

You are not authorized to merge this pull request.

This pull request can be merged automatically.

This branch is out-of-date with the base branch

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin feature/security-findings-2026-10:feature/security-findings-2026-10

git checkout feature/security-findings-2026-10

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/Lukes-Rocket-Launcher#7