From e12cecb08879519721ff6c9fdbc84d0de3781280 Mon Sep 17 00:00:00 2001 From: Arpit Jain Date: Tue, 26 May 2026 07:56:25 +0900 Subject: [PATCH] ci: declare workflow-level contents: read on lint/codeql/static-analysis All workflows just run pure checks. No GitHub API writes from workflows at workflow level. Job-level overrides for security-events on codeql remain. Post-CVE-2025-30066 hardening pattern. Signed-off-by: Arpit Jain --- .github/workflows/codeql-build.yml | 3 +++ .github/workflows/format-check.yml | 3 +++ .github/workflows/static-analysis.yml | 3 +++ 3 files changed, 9 insertions(+) diff --git a/.github/workflows/codeql-build.yml b/.github/workflows/codeql-build.yml index aadcee4..a27dfeb 100644 --- a/.github/workflows/codeql-build.yml +++ b/.github/workflows/codeql-build.yml @@ -12,6 +12,9 @@ on: - synchronize workflow_dispatch: +permissions: + contents: read + jobs: codeql: name: Codeql Analysis diff --git a/.github/workflows/format-check.yml b/.github/workflows/format-check.yml index 4ad54a9..ef2490e 100644 --- a/.github/workflows/format-check.yml +++ b/.github/workflows/format-check.yml @@ -14,6 +14,9 @@ on: workflow_dispatch: +permissions: + contents: read + jobs: format-check: name: Run format check diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml index 85dccf2..8f1159b 100644 --- a/.github/workflows/static-analysis.yml +++ b/.github/workflows/static-analysis.yml @@ -12,6 +12,9 @@ on: - synchronize workflow_dispatch: +permissions: + contents: read + jobs: static-analysis: name: Static Analysis