From e2481a6ca0b063606e9b6cf2d86c51cec5d6abf0 Mon Sep 17 00:00:00 2001 From: Christian Cleberg Date: Wed, 15 Jul 2026 19:52:20 -0500 Subject: ci: constrain GITHUB_TOKEN to contents: read MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The workflow set no permissions, so GITHUB_TOKEN inherited the repository default — read-write for repositories created before February 2023. Flagged by CodeQL as actions/missing-workflow-permissions (CWE-275). Checkout only reads the repo and xcodebuild uses no token, so contents: read covers the job. upload-artifact authenticates with the separate runtime token and is unaffected. --- .github/workflows/test.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 568ff39..c992758 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -9,6 +9,11 @@ on: pull_request: workflow_dispatch: +# Without this, GITHUB_TOKEN inherits the repository default, which is +# read-write for anything created before February 2023. The job only reads code. +permissions: + contents: read + concurrency: group: tests-${{ github.ref }} cancel-in-progress: true -- cgit v1.2.3