From fce06b21808bfbb7c9da276fdc378ce7e0ade913 Mon Sep 17 00:00:00 2001 From: Arpit Jain Date: Tue, 26 May 2026 08:06:54 +0900 Subject: [PATCH] ci: declare workflow-level contents: read on python and yaml validation Workflow runs checks only; no GitHub API writes from the workflow itself. Post-CVE-2025-30066 hardening pattern. yaml.safe_load validated. Signed-off-by: Arpit Jain --- .github/workflows/python-validation.yml | 3 +++ .github/workflows/yaml-validation.yml | 3 +++ 2 files changed, 6 insertions(+) diff --git a/.github/workflows/python-validation.yml b/.github/workflows/python-validation.yml index 5e103fc3f0..c0c2e37ecf 100644 --- a/.github/workflows/python-validation.yml +++ b/.github/workflows/python-validation.yml @@ -7,6 +7,9 @@ on: env: PYTHON_MODULES_DIR: modules/python +permissions: + contents: read + jobs: python-validation: runs-on: ubuntu-latest diff --git a/.github/workflows/yaml-validation.yml b/.github/workflows/yaml-validation.yml index aa59abdcb2..486bac6239 100644 --- a/.github/workflows/yaml-validation.yml +++ b/.github/workflows/yaml-validation.yml @@ -3,6 +3,9 @@ name: YAML Validation on: pull_request: +permissions: + contents: read + jobs: yaml-validation: runs-on: ubuntu-latest