From 22ff0f49f472a91971c6cc70202531e354273d37 Mon Sep 17 00:00:00 2001 From: Marian Steinbach Date: Fri, 30 Jan 2026 16:14:36 +0100 Subject: [PATCH] Add permissions for ossf-scorecard --- .github/workflows/ossf-scorecard.yaml | 2 ++ CHANGELOG.md | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ossf-scorecard.yaml b/.github/workflows/ossf-scorecard.yaml index 1e42659..b356e74 100644 --- a/.github/workflows/ossf-scorecard.yaml +++ b/.github/workflows/ossf-scorecard.yaml @@ -17,6 +17,8 @@ jobs: name: Scorecard analysis runs-on: ubuntu-24.04 permissions: + # Needed to checkout the repository. + contents: read # Needed to upload the results to code-scanning dashboard. security-events: write # Needed to publish results and get a badge (see publish_results below). diff --git a/CHANGELOG.md b/CHANGELOG.md index 197eb00..3baccc3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,7 +10,7 @@ Instead this file uses a date-based structure. ### Fixed -- Replace `permissions: read-all` with explicit job-level permissions in `ossf-scorecard` and `publish-techdocs` workflows to work correctly when called from workflows with restricted permissions. +- Replace `permissions: read-all` with explicit job-level permissions in `ossf-scorecard` and `publish-techdocs` workflows to work correctly when called from workflows with restricted permissions. Added missing `contents: read` permission to `ossf-scorecard` job. ## 2026-01-23