From 6372c49c362aa667e22a02bfb66ae85be88e47b3 Mon Sep 17 00:00:00 2001 From: Adnan Khan Date: Tue, 21 Oct 2025 13:51:02 -0400 Subject: [PATCH 1/3] ci: scope down permissions for release.yml --- .github/workflows/release.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1935bbd..675c478 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -4,6 +4,10 @@ on: - main name: Release +permissions: + contents: write + pull-requests: write + jobs: release-please: runs-on: ubuntu-latest From 6b31227cee82d3ef801e75c2711726f8a8eed41d Mon Sep 17 00:00:00 2001 From: Adnan Khan Date: Tue, 21 Oct 2025 13:51:04 -0400 Subject: [PATCH 2/3] ci: scope down permissions for test.yml --- .github/workflows/test.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index b5d1a40..62ba36e 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -5,6 +5,9 @@ on: pull_request: branches: ["main"] +permissions: + contents: read + jobs: test: runs-on: ubuntu-latest From e5b268c90236ffa4aec4677dad5937c3ecb6a81b Mon Sep 17 00:00:00 2001 From: Adnan Khan Date: Tue, 21 Oct 2025 13:51:06 -0400 Subject: [PATCH 3/3] ci: scope down permissions for build.yml --- .github/workflows/build.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 81c0d41..d025538 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -5,6 +5,9 @@ on: pull_request: branches: ["main"] +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest