From c723fc5bef76b5ea92a82c34e65c00efe29ac4e3 Mon Sep 17 00:00:00 2001 From: James Maes Date: Fri, 16 Oct 2026 16:12:49 -0500 Subject: [PATCH] ci: least-privilege GITHUB_TOKEN permissions Co-Authored-By: Claude Opus 5.5 --- .github/workflows/badge.yml | 3 +++ .github/workflows/c-cpp.yml | 9 +++++++++ 2 files changed, 12 insertions(+) diff --git a/.github/workflows/badge.yml b/.github/workflows/badge.yml index 66a2757..feeeda1 100644 --- a/.github/workflows/badge.yml +++ b/.github/workflows/badge.yml @@ -5,6 +5,9 @@ on: workflows: ["Build and Test Arduino Firmware"] types: [completed] +permissions: + contents: read + jobs: generate-badges: runs-on: ubuntu-latest diff --git a/.github/workflows/c-cpp.yml b/.github/workflows/c-cpp.yml index bb45057..9f0d85c 100644 --- a/.github/workflows/c-cpp.yml +++ b/.github/workflows/c-cpp.yml @@ -24,6 +24,9 @@ on: env: PLATFORMIO_VERSION: 6.1.7 +permissions: + contents: read + jobs: version: name: Determine Version @@ -305,6 +308,8 @@ jobs: retention-days: 90 create-tag: + permissions: + contents: write name: Create Git Tag runs-on: ubuntu-latest needs: [version, build-simulation, build-uno-r3, build-uno-r4-minima] @@ -423,6 +428,8 @@ jobs: fi create-release: + permissions: + contents: write name: Create Release Assets runs-on: ubuntu-latest needs: [version, build-simulation, build-uno-r3, build-uno-r4-minima, create-tag] @@ -603,6 +610,8 @@ jobs: echo "**Firmware files are available as artifacts above.**" >> $GITHUB_STEP_SUMMARY publish-package: + permissions: + contents: write name: Publish to GitHub Packages runs-on: ubuntu-latest needs: [version, build-simulation, build-uno-r3, build-uno-r4-minima, create-tag] -- 2.54.0