From a97ce40d43bd64ebecc903b7ea62c3aa6929a0f6 Mon Sep 17 00:00:00 2001 From: Arpit Jain Date: Tue, 26 May 2026 15:32:09 +0900 Subject: [PATCH] ci: declare workflow-level contents: read on maven, pr-checks, version-increments Three workflows that just run build/checks. No GitHub API writes from the workflows. contents: read at workflow level is appropriate. Post-CVE-2025-30066 hardening pattern. yaml.safe_load validated. Signed-off-by: Arpit Jain --- .github/workflows/maven.yml | 3 +++ .github/workflows/pr-checks.yml | 3 +++ .github/workflows/version-increments.yml | 3 +++ 3 files changed, 9 insertions(+) diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml index c34020b35c2..f0678c3f29e 100644 --- a/.github/workflows/maven.yml +++ b/.github/workflows/maven.yml @@ -20,6 +20,9 @@ on: branches: [ master ] types: [opened, reopened, synchronize, labeled] +permissions: + contents: read + jobs: event_file: name: "Event File" diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index dcac225bc77..101edbefa78 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -9,6 +9,9 @@ on: pull_request: branches: [ master ] +permissions: + contents: read + jobs: check-freeze-period: uses: eclipse-platform/eclipse.platform.releng.aggregator/.github/workflows/verifyFreezePeriod.yml@master diff --git a/.github/workflows/version-increments.yml b/.github/workflows/version-increments.yml index 7f0450b41ac..c4d9915aefb 100644 --- a/.github/workflows/version-increments.yml +++ b/.github/workflows/version-increments.yml @@ -5,6 +5,9 @@ on: workflows: [ 'Pull-Request Checks' ] types: [ completed ] +permissions: + contents: read + jobs: publish-version-check-results: uses: eclipse-platform/eclipse.platform.releng.aggregator/.github/workflows/publishVersionCheckResults.yml@master