From 013ae674ffc954f907a298df79c2ba1ea85d0104 Mon Sep 17 00:00:00 2001 From: Arpit Jain Date: Sun, 24 May 2026 11:26:10 +0900 Subject: [PATCH] ci: declare workflow-level contents: read on 3 check workflows format-check, codeql-build, static-analysis are pure check workflows. No GitHub API writes from the workflows themselves. Workflow-level contents: read is appropriate. Post-CVE-2025-30066 hardening pattern. yaml.safe_load validated. Signed-off-by: Arpit Jain --- .github/workflows/codeql-build.yml | 3 +++ .github/workflows/format-check.yml | 3 +++ .github/workflows/static-analysis.yml | 3 +++ 3 files changed, 9 insertions(+) diff --git a/.github/workflows/codeql-build.yml b/.github/workflows/codeql-build.yml index 5cd3b49..3e24f21 100644 --- a/.github/workflows/codeql-build.yml +++ b/.github/workflows/codeql-build.yml @@ -12,6 +12,9 @@ on: - synchronize workflow_dispatch: +permissions: + contents: read + jobs: codeql: name: Codeql Analysis diff --git a/.github/workflows/format-check.yml b/.github/workflows/format-check.yml index a47839d..bb03a3a 100644 --- a/.github/workflows/format-check.yml +++ b/.github/workflows/format-check.yml @@ -13,6 +13,9 @@ on: - synchronize workflow_dispatch: +permissions: + contents: read + jobs: format-check: name: Run format check diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml index 85dccf2..8f1159b 100644 --- a/.github/workflows/static-analysis.yml +++ b/.github/workflows/static-analysis.yml @@ -12,6 +12,9 @@ on: - synchronize workflow_dispatch: +permissions: + contents: read + jobs: static-analysis: name: Static Analysis