ci: least-privilege GITHUB_TOKEN permissions #2

2026-10-16T21:12:29Z

KofTwentyTwo commented

2026-10-16 21:12:29 +00:00

(Migrated from github.com)

Fixes #1

Adds workflow-level permissions: contents: read to all workflows and grants write scopes only where a job needs them:

ci.yml test: checks: write for clippy-check annotations.
dependabot.yml: contents: write, pull-requests: write for auto-merge.
release.yml create-release / build: contents: write to create the release and upload assets.

Resolves code-scanning alerts #1-#8 (actions/missing-workflow-permissions). YAML validated.

🤖 Generated with Claude Code

Fixes #1 Adds workflow-level `permissions: contents: read` to all workflows and grants write scopes only where a job needs them: - ci.yml `test`: `checks: write` for clippy-check annotations. - dependabot.yml: `contents: write`, `pull-requests: write` for auto-merge. - release.yml `create-release` / `build`: `contents: write` to create the release and upload assets. Resolves code-scanning alerts #1-#8 (`actions/missing-workflow-permissions`). YAML validated. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Checking for merge conflicts…

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin feature/security-findings-2026-10:feature/security-findings-2026-10

git checkout feature/security-findings-2026-10

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/kfmtbox#2