From 888fcc2084797e8456e76b6ee321c38417193387 Mon Sep 17 00:00:00 2001 From: Luis Betancourt <225334064+LueBangs-coder@users.noreply.github.com> Date: Sat, 27 Jun 2026 09:58:32 -0400 Subject: [PATCH] ci: set least-privilege token permissions on CI workflow The CI workflow had no top-level `permissions:` block, so its GITHUB_TOKEN inherited the broad repository-default scopes. The test job only checks out the repo and runs the suite, so it needs `contents: read` and nothing more. Pinning the scope clears the OpenSSF Scorecard "Token-Permissions" finding. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/ci.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 04a0ec7..68afe19 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,6 +6,12 @@ on: pull_request: branches: [main] +# Least privilege: the CI job only reads the repo to run tests. Setting the +# token scope here (rather than relying on the broad repository default) +# clears the OpenSSF Scorecard "Token-Permissions" finding. +permissions: + contents: read + jobs: test: runs-on: ubuntu-latest