From 69c378f2d306fc7e85d2e48d81637a2136d9c6ff Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mat=C3=ADas=20Insaurralde?= <matias@chainloop.dev>
Date: Thu, 12 Mar 2026 22:42:53 -0300
Subject: [PATCH] chore(ci): migrate CodeQL workflow to GitHub keyless auth
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Matías Insaurralde <matias@chainloop.dev>
---
 .github/workflows/codeql.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 9efc1533b..56950d13f 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -11,6 +11,7 @@ on:
 
 permissions:
   contents: read
+  id-token: write # required for SLSA attestation
 
 jobs:
   analyze:
@@ -22,7 +23,6 @@ jobs:
       security-events: write
       id-token: write # required for SLSA provenance - https://docs.chainloop.dev/guides/slsa/
     env:
-      CHAINLOOP_TOKEN: ${{ secrets.CHAINLOOP_TOKEN }}
       CHAINLOOP_WORKFLOW_NAME: "codeql"
       CHAINLOOP_PROJECT: "chainloop"