From 2525e4b6719c5de5f4170e9c3d38f36b0d310501 Mon Sep 17 00:00:00 2001
From: Jen Hamon <jhamon@pinecone.io>
Date: Sat, 11 Jul 2026 16:27:17 -0400
Subject: [PATCH] ci: add least-privilege workflow permissions (CodeQL)

Add explicit top-level permissions blocks to CI and CD workflows to
satisfy the principle of least privilege and resolve two CodeQL
actions/missing-workflow-permissions alerts.

- CI.yaml: permissions: contents: read (read-only test runner)
- CD.yaml: permissions: contents: write (creates git tags and GitHub releases)

Resolves CodeQL alerts #1 (CI.yaml) and #2 (CD.yaml).

PIN-24
---
 .github/workflows/CD.yaml | 3 +++
 .github/workflows/CI.yaml | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/.github/workflows/CD.yaml b/.github/workflows/CD.yaml
index ce45e05..f921ac8 100644
--- a/.github/workflows/CD.yaml
+++ b/.github/workflows/CD.yaml
@@ -3,6 +3,9 @@ name: CD
 on:
   workflow_dispatch:
 
+permissions:
+  contents: write
+
 jobs:
 
   release:
diff --git a/.github/workflows/CI.yaml b/.github/workflows/CI.yaml
index b379b72..0f47884 100644
--- a/.github/workflows/CI.yaml
+++ b/.github/workflows/CI.yaml
@@ -4,6 +4,9 @@ on:
   - pull_request
   - merge_group
 
+permissions:
+  contents: read
+
 jobs:
   run-tests:
     name: Run tests