From a0863ec7b09883e35654872596db337ce3763edd Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 13:34:00 +0200 Subject: [PATCH 1/6] CI: add least-privilege permissions to GitHub Actions workflows Add explicit workflow-level permissions blocks to resolve CodeQL actions/missing-workflow-permissions alerts. Scopes are derived from workflow operations (git push, artifact upload, Danger, release lanes). Refs: APPSEC-164 --- .github/workflows/android_ci.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/android_ci.yml b/.github/workflows/android_ci.yml index d50fd880b..bf6ea4eca 100644 --- a/.github/workflows/android_ci.yml +++ b/.github/workflows/android_ci.yml @@ -9,6 +9,10 @@ on: paths-ignore: - '**.md' +permissions: + contents: read + pull-requests: read + jobs: android-compile: runs-on: ubuntu-latest From ffa4f6b904a06baaf604562e75e7518148f5e7c6 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 13:34:01 +0200 Subject: [PATCH 2/6] CI: add least-privilege permissions to GitHub Actions workflows Add explicit workflow-level permissions blocks to resolve CodeQL actions/missing-workflow-permissions alerts. Scopes are derived from workflow operations (git push, artifact upload, Danger, release lanes). Refs: APPSEC-164 --- .github/workflows/ci.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3d554fd84..12bff4e5b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -2,6 +2,10 @@ name: Simple CI on: [pull_request] +permissions: + contents: read + pull-requests: read + jobs: run-ci: name: Lint From 98a5ddb8ea1d31fb571d52408697035d50c2eb9d Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Wed, 8 Jul 2026 13:34:02 +0200 Subject: [PATCH 3/6] CI: add least-privilege permissions to GitHub Actions workflows Add explicit workflow-level permissions blocks to resolve CodeQL actions/missing-workflow-permissions alerts. Scopes are derived from workflow operations (git push, artifact upload, Danger, release lanes). Refs: APPSEC-164 --- .github/workflows/ios_ci.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/ios_ci.yml b/.github/workflows/ios_ci.yml index 50d831411..0c5596fa3 100644 --- a/.github/workflows/ios_ci.yml +++ b/.github/workflows/ios_ci.yml @@ -9,6 +9,11 @@ on: paths-ignore: - '**.md' +permissions: + actions: write + contents: read + pull-requests: read + jobs: ios-compile: runs-on: macos-latest From 7b6d63bf6be532add1be21b5ef9be306a3faff2f Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Tue, 14 Jul 2026 13:54:06 +0200 Subject: [PATCH 4/6] fix(ci): align workflow token permissions with actual operations --- .github/workflows/android_ci.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/android_ci.yml b/.github/workflows/android_ci.yml index bf6ea4eca..4c984467a 100644 --- a/.github/workflows/android_ci.yml +++ b/.github/workflows/android_ci.yml @@ -11,7 +11,6 @@ on: permissions: contents: read - pull-requests: read jobs: android-compile: From 5729ec7022b1e0a41a2c406bc016a9f904f04dc1 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Tue, 14 Jul 2026 13:54:07 +0200 Subject: [PATCH 5/6] fix(ci): align workflow token permissions with actual operations --- .github/workflows/ci.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 12bff4e5b..546bf3799 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -4,7 +4,6 @@ on: [pull_request] permissions: contents: read - pull-requests: read jobs: run-ci: From 0f975d1cc051bf6dcddf47afabfa062077994cba Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Tue, 14 Jul 2026 13:57:35 +0200 Subject: [PATCH 6/6] fix(ci): align workflow token permissions with actual operations --- .github/workflows/ios_ci.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/ios_ci.yml b/.github/workflows/ios_ci.yml index 0c5596fa3..23984c811 100644 --- a/.github/workflows/ios_ci.yml +++ b/.github/workflows/ios_ci.yml @@ -12,7 +12,6 @@ on: permissions: actions: write contents: read - pull-requests: read jobs: ios-compile: