diff options
| author | Christian Cleberg <[email protected]> | 2026-07-15 19:52:20 -0500 |
|---|---|---|
| committer | Christian Cleberg <[email protected]> | 2026-07-15 19:52:20 -0500 |
| commit | e2481a6ca0b063606e9b6cf2d86c51cec5d6abf0 (patch) | |
| tree | 9bf251339d016f2605463cc0b9a78a8b2c4188af /Hutch/Views | |
| parent | d97a1a6ea2ca843d3c2e91d17bd82b21cecf76cf (diff) | |
| download | hutch-e2481a6ca0b063606e9b6cf2d86c51cec5d6abf0.tar.gz hutch-e2481a6ca0b063606e9b6cf2d86c51cec5d6abf0.tar.bz2 hutch-e2481a6ca0b063606e9b6cf2d86c51cec5d6abf0.zip | |
ci: constrain GITHUB_TOKEN to contents: read
The workflow set no permissions, so GITHUB_TOKEN inherited the repository
default — read-write for repositories created before February 2023. Flagged by
CodeQL as actions/missing-workflow-permissions (CWE-275).
Checkout only reads the repo and xcodebuild uses no token, so contents: read
covers the job. upload-artifact authenticates with the separate runtime token
and is unaffected.
Diffstat (limited to 'Hutch/Views')
0 files changed, 0 insertions, 0 deletions