From f0f157955585cf098e8441a595779489c3d6a8ec Mon Sep 17 00:00:00 2001 From: James Maes Date: Fri, 16 Oct 2026 16:12:21 -0500 Subject: [PATCH] ci: least-privilege GITHUB_TOKEN permissions Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 6 ++++++ .github/workflows/dependabot.yml | 6 ++++++ .github/workflows/release.yml | 7 +++++++ 3 files changed, 19 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ac5d70b..281c8b3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -9,8 +9,14 @@ on: env: CARGO_TERM_COLOR: always +permissions: + contents: read + jobs: test: + permissions: + contents: read + checks: write name: Test runs-on: ubuntu-latest strategy: diff --git a/.github/workflows/dependabot.yml b/.github/workflows/dependabot.yml index 289fe55..90e9ee3 100644 --- a/.github/workflows/dependabot.yml +++ b/.github/workflows/dependabot.yml @@ -4,8 +4,14 @@ on: pull_request: types: [opened, synchronize] +permissions: + contents: read + jobs: dependabot: + permissions: + contents: write + pull-requests: write runs-on: ubuntu-latest if: github.actor == 'dependabot[bot]' steps: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1ca9ee7..774d6b8 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -8,8 +8,13 @@ on: env: CARGO_TERM_COLOR: always +permissions: + contents: read + jobs: create-release: + permissions: + contents: write runs-on: ubuntu-latest outputs: upload_url: ${{ steps.create_release.outputs.upload_url }} @@ -29,6 +34,8 @@ jobs: prerelease: false build: + permissions: + contents: write needs: create-release strategy: matrix: -- 2.54.0