From 2cfea28a7b779e91f5a53cea2e7f346162be1960 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 17 Jul 2026 06:26:00 +0000 Subject: [PATCH] ci: add least-privilege permissions to test and lint jobs Address CodeQL findings (#29, #30) for workflows missing an explicit permissions block. The test and lint jobs only need read access to repository contents, so scope them to contents: read. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_017DWsidVYPVzvKZGq2cqrBd --- .github/workflows/ci.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ee8e643..c8521b5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -10,6 +10,8 @@ jobs: test: name: Test runs-on: ubuntu-latest + permissions: + contents: read strategy: matrix: go-version: ["1.26.1"] @@ -57,6 +59,8 @@ jobs: lint: name: Lint runs-on: ubuntu-latest + permissions: + contents: read steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2