From 763c3625c07cec0fbd19c66940a7a62fc4671b54 Mon Sep 17 00:00:00 2001 From: Arpit Jain Date: Tue, 26 May 2026 07:56:14 +0900 Subject: [PATCH] ci: declare workflow-level contents: read on lint/codeql/static-analysis All workflows just run pure checks. No GitHub API writes from workflows at workflow level. Job-level overrides for security-events on codeql remain. Post-CVE-2025-30066 hardening pattern. Signed-off-by: Arpit Jain --- .github/workflows/codeql-build.yml | 3 +++ .github/workflows/format-check.yml | 3 +++ .github/workflows/static-analysis.yml | 3 +++ 3 files changed, 9 insertions(+) diff --git a/.github/workflows/codeql-build.yml b/.github/workflows/codeql-build.yml index 95685ed..3600c11 100644 --- a/.github/workflows/codeql-build.yml +++ b/.github/workflows/codeql-build.yml @@ -12,6 +12,9 @@ on: - synchronize workflow_dispatch: +permissions: + contents: read + jobs: codeql: name: Codeql Analysis diff --git a/.github/workflows/format-check.yml b/.github/workflows/format-check.yml index a47839d..bb03a3a 100644 --- a/.github/workflows/format-check.yml +++ b/.github/workflows/format-check.yml @@ -13,6 +13,9 @@ on: - synchronize workflow_dispatch: +permissions: + contents: read + jobs: format-check: name: Run format check diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml index 85dccf2..8f1159b 100644 --- a/.github/workflows/static-analysis.yml +++ b/.github/workflows/static-analysis.yml @@ -12,6 +12,9 @@ on: - synchronize workflow_dispatch: +permissions: + contents: read + jobs: static-analysis: name: Static Analysis