Skip to content

Commit d7733e2

Browse files
MarkoVcodeclaude
andcommitted
Add explicit permissions to GitHub Actions workflows
Add GITHUB_TOKEN permissions blocks to workflows following security best practices (principle of least privilege): - ci.yaml: Add 'contents: read' (only needs to checkout code) - test.yml: Add 'contents: read' (only needs to checkout code) - sync-wiki.yml: Add 'contents: write' (needs to push to wiki) Existing workflows already have permissions: - draft-release.yml: 'contents: write' (creates releases) - release-electron.yml: 'contents: write' (creates releases) This addresses GitHub security warnings about workflows not limiting GITHUB_TOKEN permissions. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
1 parent 46bd93f commit d7733e2

3 files changed

Lines changed: 9 additions & 0 deletions

File tree

.github/workflows/ci.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@ on:
55
branches: ["**"]
66
pull_request:
77

8+
permissions:
9+
contents: read # Required to checkout code
10+
811
jobs:
912
test:
1013
runs-on: ubuntu-latest

.github/workflows/sync-wiki.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@ on:
88
- 'docs/**/*.md'
99
workflow_dispatch: # Allow manual trigger
1010

11+
permissions:
12+
contents: write # Required to checkout code and push to wiki
13+
1114
jobs:
1215
sync-wiki:
1316
runs-on: ubuntu-latest

.github/workflows/test.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ on:
66
pull_request:
77
branches: [ main, develop ]
88

9+
permissions:
10+
contents: read # Required to checkout code
11+
912
jobs:
1013
test-frontend:
1114
runs-on: ubuntu-latest

0 commit comments

Comments
 (0)