From 7edcac2b95ce246d9f245327b48bd50753a3c62b Mon Sep 17 00:00:00 2001 From: John Kennedy <65985482+jkennedyvz@users.noreply.github.com> Date: Tue, 31 Mar 2026 08:43:43 +0000 Subject: [PATCH] ci: add least-privilege permissions to workflow files Both unit-tests.yml and integration-tests.yml were missing top-level permissions declarations, triggering code scanning alerts for actions/missing-workflow-permissions. These workflows only check out code and run tests, so `contents: read` is sufficient. Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/integration-tests.yml | 3 +++ .github/workflows/unit-tests.yml | 3 +++ 2 files changed, 6 insertions(+) diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml index f09af43..d33e145 100644 --- a/.github/workflows/integration-tests.yml +++ b/.github/workflows/integration-tests.yml @@ -7,6 +7,9 @@ on: - cron: "37 14 * * *" # Run at 7:37 AM Pacific Time (14:37 UTC) every day workflow_dispatch: # Allows triggering the workflow manually in GitHub UI +permissions: + contents: read + # If another scheduled run starts while this workflow is still running, # cancel the earlier run in favor of the next run. concurrency: diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml index 055407c..4e931d0 100644 --- a/.github/workflows/unit-tests.yml +++ b/.github/workflows/unit-tests.yml @@ -8,6 +8,9 @@ on: pull_request: workflow_dispatch: # Allows triggering the workflow manually in GitHub UI +permissions: + contents: read + # If another push to the same PR or branch happens while this workflow is still running, # cancel the earlier run in favor of the next run. concurrency: