From 80ff6e450aa58009db125b65d0593b9121dbca6a Mon Sep 17 00:00:00 2001 From: Arpit Jain Date: Mon, 25 May 2026 12:36:11 +0900 Subject: [PATCH] ci: declare workflow-level contents: read on test and dist-typecheck Both workflows run pure tests / typecheck; no GitHub API writes. Post-CVE-2025-30066 hardening pattern. Signed-off-by: Arpit Jain --- .github/workflows/dist-typecheck.yml | 3 +++ .github/workflows/test.yml | 3 +++ 2 files changed, 6 insertions(+) diff --git a/.github/workflows/dist-typecheck.yml b/.github/workflows/dist-typecheck.yml index 8cdbef56..192446ff 100644 --- a/.github/workflows/dist-typecheck.yml +++ b/.github/workflows/dist-typecheck.yml @@ -6,6 +6,9 @@ on: branches: - main +permissions: + contents: read + jobs: typecheck-dist: name: Check dist types diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index f11bff2e..b294f84c 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -7,6 +7,9 @@ on: pull_request: branches: [main] +permissions: + contents: read + jobs: test: runs-on: ubuntu-latest