From 4a480809cc63b57a898b4612d2dadcaf0924104a Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 27 Mar 2026 02:45:45 +0000 Subject: [PATCH] Add permissions to all workflow jobs for least-privilege security Following the pattern from PR #1074, add `permissions: contents: read` to all workflow jobs that only need read access. The release-winget workflow already has appropriate write permissions. https://claude.ai/code/session_01PH4HxLHfpWeSNSS1MvK6f9 --- .github/workflows/bazel.yml | 2 ++ .github/workflows/check-dictionary-sorted.yml | 2 ++ .github/workflows/cmake.yml | 2 ++ .github/workflows/mingw.yml | 2 ++ .github/workflows/msvc.yml | 2 ++ .github/workflows/nodejs.yml | 2 ++ .github/workflows/python.yml | 4 ++++ 7 files changed, 16 insertions(+) diff --git a/.github/workflows/bazel.yml b/.github/workflows/bazel.yml index 148b9681f..e0abc6ac2 100644 --- a/.github/workflows/bazel.yml +++ b/.github/workflows/bazel.yml @@ -12,6 +12,8 @@ concurrency: jobs: build-and-test: + permissions: + contents: read runs-on: ${{ matrix.os }} strategy: matrix: diff --git a/.github/workflows/check-dictionary-sorted.yml b/.github/workflows/check-dictionary-sorted.yml index ece3240a4..e8dc0f7f4 100644 --- a/.github/workflows/check-dictionary-sorted.yml +++ b/.github/workflows/check-dictionary-sorted.yml @@ -10,6 +10,8 @@ concurrency: jobs: sort-check: + permissions: + contents: read runs-on: ubuntu-latest steps: - name: Checkout diff --git a/.github/workflows/cmake.yml b/.github/workflows/cmake.yml index a3ca6ecf3..b12b22456 100644 --- a/.github/workflows/cmake.yml +++ b/.github/workflows/cmake.yml @@ -12,6 +12,8 @@ concurrency: jobs: build-and-test: + permissions: + contents: read runs-on: ${{ matrix.os }} strategy: matrix: diff --git a/.github/workflows/mingw.yml b/.github/workflows/mingw.yml index 569c4fe9d..99241c344 100644 --- a/.github/workflows/mingw.yml +++ b/.github/workflows/mingw.yml @@ -12,6 +12,8 @@ concurrency: jobs: build: + permissions: + contents: read runs-on: windows-latest defaults: run: diff --git a/.github/workflows/msvc.yml b/.github/workflows/msvc.yml index 15be85e5f..ae2f48b52 100644 --- a/.github/workflows/msvc.yml +++ b/.github/workflows/msvc.yml @@ -12,6 +12,8 @@ concurrency: jobs: build-and-test: + permissions: + contents: read runs-on: windows-latest strategy: matrix: diff --git a/.github/workflows/nodejs.yml b/.github/workflows/nodejs.yml index 782b25821..73c2879dd 100644 --- a/.github/workflows/nodejs.yml +++ b/.github/workflows/nodejs.yml @@ -12,6 +12,8 @@ concurrency: jobs: build-and-test: + permissions: + contents: read runs-on: ${{ matrix.os }} strategy: diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml index 443ac3930..9dead5a06 100644 --- a/.github/workflows/python.yml +++ b/.github/workflows/python.yml @@ -12,6 +12,8 @@ concurrency: jobs: unit-test: + permissions: + contents: read runs-on: ubuntu-latest strategy: matrix: @@ -57,6 +59,8 @@ jobs: pytest.xml test-pypi: + permissions: + contents: read strategy: matrix: os: [ubuntu-latest, macos-latest, macos-14, windows-latest]