From c16e0405ebf49f21fef2abd022da938ff8449c5b Mon Sep 17 00:00:00 2001 From: Kiernan McGowan Date: Mon, 17 Aug 2026 10:26:18 -0700 Subject: [PATCH] Set least-privilege GITHUB_TOKEN permissions on CI (API-927) The CI workflow set no explicit permissions block, so the registry job's GITHUB_TOKEN was granted the broad default scope. CodeQL flagged it as actions/missing-workflow-permissions. Read the whole job before choosing the scope: checkout, pnpm setup, install, typecheck, lint, test, build, and a git diff --exit-code r/ freshness check. Nothing publishes to npm, pushes a tag, or comments on the PR, so no step needs a write scope and contents: read covers all nine. Set at the top level rather than per-job so a job added later inherits least privilege instead of the default, matching API-885 in the logo repo and the arena half of this ticket. Co-Authored-By: Claude Fable 5 --- .github/workflows/ci.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2d3dc20..2dbb77b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -4,6 +4,10 @@ on: branches: [main] pull_request: branches: [main] +# The registry job only reads the repo, so the GITHUB_TOKEN needs nothing more. +# Set at the top level so any job added later inherits least privilege. +permissions: + contents: read jobs: registry: runs-on: ubuntu-latest