From e2dd2491983c494081929fd2c358558ae98a5dfe Mon Sep 17 00:00:00 2001
From: "posthog[bot]" <206114724+posthog[bot]@users.noreply.github.com>
Date: Sun, 16 Aug 2026 18:07:01 +0000
Subject: [PATCH] Set least-privilege GITHUB_TOKEN scope on CI workflow

Add a workflow-level `permissions:` block with `contents: read` to
`.github/workflows/ci.yml`. The `registry` job only checks out code and
runs read-only steps, so it does not need the default full token scope.

This closes the CodeQL medium-severity alert for this workflow.

Generated-By: PostHog Desktop
Task-Id: 81966967-a939-4197-8666-c73a2f638650
---
 .github/workflows/ci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2d3dc20..742012c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,6 +4,8 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+permissions:
+  contents: read
 jobs:
   registry:
     runs-on: ubuntu-latest