diff options
| author | Christian Cleberg <[email protected]> | 2026-07-15 19:52:20 -0500 |
|---|---|---|
| committer | Christian Cleberg <[email protected]> | 2026-07-15 19:52:20 -0500 |
| commit | e2481a6ca0b063606e9b6cf2d86c51cec5d6abf0 (patch) | |
| tree | 9bf251339d016f2605463cc0b9a78a8b2c4188af | |
| parent | d97a1a6ea2ca843d3c2e91d17bd82b21cecf76cf (diff) | |
| download | hutch-e2481a6ca0b063606e9b6cf2d86c51cec5d6abf0.tar.gz hutch-e2481a6ca0b063606e9b6cf2d86c51cec5d6abf0.tar.bz2 hutch-e2481a6ca0b063606e9b6cf2d86c51cec5d6abf0.zip | |
ci: constrain GITHUB_TOKEN to contents: read
The workflow set no permissions, so GITHUB_TOKEN inherited the repository
default — read-write for repositories created before February 2023. Flagged by
CodeQL as actions/missing-workflow-permissions (CWE-275).
Checkout only reads the repo and xcodebuild uses no token, so contents: read
covers the job. upload-artifact authenticates with the separate runtime token
and is unaffected.
| -rw-r--r-- | .github/workflows/test.yml | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 568ff39..c992758 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -9,6 +9,11 @@ on: pull_request: workflow_dispatch: +# Without this, GITHUB_TOKEN inherits the repository default, which is +# read-write for anything created before February 2023. The job only reads code. +permissions: + contents: read + concurrency: group: tests-${{ github.ref }} cancel-in-progress: true |