From cdecd7b83c0b77f6938f008e3e1518f2dc014127 Mon Sep 17 00:00:00 2001 From: Arpit Jain Date: Thu, 28 May 2026 10:51:16 +0900 Subject: [PATCH] ci: scope workflow token to read-only Restrict the GITHUB_TOKEN to contents: read since the CI workflow only needs to check out source and run tests. Signed-off-by: Arpit Jain --- .github/workflows/ci.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index abf2107..4f64aa5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -2,6 +2,9 @@ name: CI on: [push, pull_request] +permissions: + contents: read + jobs: ubuntu: strategy: