Joe MattielloandClaude Opus 5.5 b58f42acea ci: declare least-privilege workflow token permissions (#1197) ...

Set `permissions: contents: read` at the top of every workflow and grant
more per job only where that job uses it, so the repo's default workflow
token can later be flipped to read-only without breaking CI.

No step, trigger or `runs-on` changes; same-repo runner guards are intact.

Co-authored-by: Claude Opus 5.5 <[email protected]>

2026-11-08 20:11:09 -05:00

..

acid-test.yml

ci: declare least-privilege workflow token permissions (#1197)

2026-11-08 20:11:09 -05:00

app-package.yml

fix(tom): show the whole unblanked line, border after HDE (#1191) (#1192)

2026-11-08 02:37:29 -05:00

app.yml

ci: declare least-privilege workflow token permissions (#1197)

2026-11-08 20:11:09 -05:00

artifacts.yml

ci: declare least-privilege workflow token permissions (#1197)

2026-11-08 20:11:09 -05:00

c-cpp.yml

ci: declare least-privilege workflow token permissions (#1197)

2026-11-08 20:11:09 -05:00

chdman-tools.yml

ci: set -eu in the Windows signing sidecar steps (#1150)

2026-11-04 13:52:03 -05:00

cheat-import.yml

site: derive BIOS_REJECT and black-video labels by cause (#976) (#1170)

2026-11-04 00:02:22 -05:00

cheat-packs-bump.yml

ci: declare least-privilege workflow token permissions (#1197)

2026-11-08 20:11:09 -05:00

clang-format.yml

ci: declare least-privilege workflow token permissions (#1197)

2026-11-08 20:11:09 -05:00

claude.yml

ci: declare least-privilege workflow token permissions (#1197)

2026-11-08 20:11:09 -05:00

close-referenced-issues.yml

ci: declare least-privilege workflow token permissions (#1197)

2026-11-08 20:11:09 -05:00

crowdin_initial_setup.yml

ci: declare least-privilege workflow token permissions (#1197)

2026-11-08 20:11:09 -05:00

crowdin_source_upload.yml

ci: declare least-privilege workflow token permissions (#1197)

2026-11-08 20:11:09 -05:00

crowdin_translation_sync.yml

ci: declare least-privilege workflow token permissions (#1197)

2026-11-08 20:11:09 -05:00

gl-qualification.yml

ci(gl-qualification): key the Windows renderer check on the Mesa fallback; bound Linux shaders_gl (#1182)

2026-11-05 22:39:53 -05:00

installer.yml

ci: declare least-privilege workflow token permissions (#1197)

2026-11-08 20:11:09 -05:00

ir-ab.yml

ci: declare least-privilege workflow token permissions (#1197)

2026-11-08 20:11:09 -05:00

jaguar-demos.yml

ci: declare least-privilege workflow token permissions (#1197)

2026-11-08 20:11:09 -05:00

jaguar-toolchain-image.yml

ci: declare least-privilege workflow token permissions (#1197)

2026-11-08 20:11:09 -05:00

jaguar-toolchain.yml

ci: declare least-privilege workflow token permissions (#1197)

2026-11-08 20:11:09 -05:00

kimi-review.yml

ci: declare least-privilege workflow token permissions (#1197)

2026-11-08 20:11:09 -05:00

labeler.yml

ci: declare least-privilege workflow token permissions (#1197)

2026-11-08 20:11:09 -05:00

librashader.yml

ci: GL qualification: windowed boot + every shader preset on Linux, Windows x64/arm64 and macOS (#1155) (#1160)

2026-11-05 20:04:02 -05:00

microbench.yml

ci: declare least-privilege workflow token permissions (#1197)

2026-11-08 20:11:09 -05:00

nightly-staleness.yml

ci: trim develop-push runs, debounce nightly, route macOS to Studio runner (#1074)

2026-10-22 23:24:46 -04:00

pages.yml

ci: declare least-privilege workflow token permissions (#1197)

2026-11-08 20:11:09 -05:00

pr-issue-link.yml

ci: declare least-privilege workflow token permissions (#1197)

2026-11-08 20:11:09 -05:00

pull-request.yml

ci: declare least-privilege workflow token permissions (#1197)

2026-11-08 20:11:09 -05:00

rebase.yml

ci: declare least-privilege workflow token permissions (#1197)

2026-11-08 20:11:09 -05:00

regression-test.yml

ci: declare least-privilege workflow token permissions (#1197)

2026-11-08 20:11:09 -05:00

release-scripts.yml

ci(release): attest, sign and gate every release asset (#1151, #1152)

2026-11-02 21:36:57 -05:00

release.yml

ci: declare least-privilege workflow token permissions (#1197)

2026-11-08 20:11:09 -05:00

steam-package.yml

feat(packaging): prepare Steam and sandboxed Mac App Store builds (#1112)

2026-10-31 22:41:49 -04:00

version-bump.yml

ci: declare least-privilege workflow token permissions (#1197)

2026-11-08 20:11:09 -05:00

warn-pr-base.yml

ci: declare least-privilege workflow token permissions (#1197)

2026-11-08 20:11:09 -05:00

windows-store.yml

ci: declare least-privilege workflow token permissions (#1197)

2026-11-08 20:11:09 -05:00