ci: default GITHUB_TOKEN to contents: read #67

2026-10-16T21:13:50Z

KofTwentyTwo commented

2026-10-16 21:13:50 +00:00

(Migrated from github.com)

Fixes #66

Adds workflow-level permissions: contents: read as the default for test, build-native and update-homebrew (which pushes with its own tap token). Jobs that already declare permissions (release, docker, update-scoop, update-aur) are unchanged.

Resolves code-scanning alerts #1-#3 (actions/missing-workflow-permissions). YAML validated.

🤖 Generated with Claude Code

Fixes #66 Adds workflow-level `permissions: contents: read` as the default for `test`, `build-native` and `update-homebrew` (which pushes with its own tap token). Jobs that already declare permissions (`release`, `docker`, `update-scoop`, `update-aur`) are unchanged. Resolves code-scanning alerts #1-#3 (`actions/missing-workflow-permissions`). YAML validated. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Checking for merge conflicts…

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin feature/security-findings-2026-10:feature/security-findings-2026-10

git checkout feature/security-findings-2026-10

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qctl#67