From a4627dd147b6f4d8ec4e6c55ea0950f4a3dab808 Mon Sep 17 00:00:00 2001 From: Stefan Zimmermann <5945920+StefanZ8n@users.noreply.github.com> Date: Wed, 16 Sep 2026 13:23:36 +0200 Subject: [PATCH] Restrict the CI workflow's GITHUB_TOKEN to read-only The CI jobs only check out, build and test, yet ran with the default token permissions. Add a top-level read-only permissions block, as the release workflow already does. Resolves three CodeQL actions/missing-workflow-permissions alerts. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/ci.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4fa5842..ea941c7 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -5,6 +5,10 @@ on: branches: [main] pull_request: +# The CI jobs only check out, build and test; a read-only token is enough. +permissions: + contents: read + jobs: go: runs-on: ubuntu-latest