From d1cc93f1a0de3385d58476e03280052258415104 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Azer=20Ko=C3=A7ulu?= Date: Tue, 29 Sep 2026 15:58:39 +0200 Subject: [PATCH] CI: the workflow token reads the repo and nothing more Closes code scanning alert 1 (actions/missing-workflow-permissions). Co-Authored-By: Claude Fable 5.1 --- .github/workflows/ci.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a4bad07..d023079 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,6 +6,10 @@ on: push: branches: [main] +# The job only reads the repo; the token gets nothing more. +permissions: + contents: read + jobs: test: runs-on: ubuntu-latest