From 6e42b16d5b242c2d417421b030ea67c2c56b6795 Mon Sep 17 00:00:00 2001 From: Coding-Dev-Tools Date: Mon, 14 Sep 2026 00:36:14 -0400 Subject: [PATCH] fix release CodeQL API permissions --- .github/workflows/release.yml | 1 + tests/test_release_infrastructure.py | 1 + 2 files changed, 2 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 89bb76f5..527b9856 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -707,6 +707,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read + security-events: write env: CODEQL_ACTION_DIFF_INFORMED_QUERIES: "false" strategy: diff --git a/tests/test_release_infrastructure.py b/tests/test_release_infrastructure.py index af6a5595..8cf31679 100644 --- a/tests/test_release_infrastructure.py +++ b/tests/test_release_infrastructure.py @@ -394,6 +394,7 @@ def test_tag_release_binds_codeql_reproducibility_and_installed_artifact_smokes( assert pin in constraints assert 'language: ["python", "javascript-typescript"]' in codeql assert 'CODEQL_ACTION_DIFF_INFORMED_QUERIES: "false"' in codeql + assert "contents: read\n security-events: write" in codeql assert "github/codeql-action/init@" in codeql assert "github/codeql-action/analyze@" in codeql assert "upload: never" in codeql