From 4d2b6c3802c051a2edde4e89b1d9fe5ccb73e017 Mon Sep 17 00:00:00 2001 From: Douglas Eichelberger Date: Mon, 17 Aug 2026 12:09:54 -0700 Subject: [PATCH] Add explicit GITHUB_TOKEN permissions to ci.yml and audit.yml Resolves CodeQL actions/missing-workflow-permissions alerts #1, #2, #3, #9. ci.yml (alerts #1 check, #3 test, #9 lints): all three jobs only check out the repo and run cargo check / cargo test / cargo fmt + clippy. Nothing writes back to GitHub, so a single workflow-level `contents: read` covers every job. audit.yml (alert #2): actions-rs/audit-check needs more than read. Its main.ts branches on the event name -- on `schedule` it calls reporter.reportIssues, which does client.issues.create (needs `issues: write`); on every other event (`push`, `pull_request` here) it calls reporter.reportCheck, which creates and updates a check run (needs `checks: write`). `contents: read` covers actions/checkout and cargo generate-lockfile. Scoped at the job rather than the workflow so a future job added to this file does not inherit the write scopes. release.yml already declares its own permissions and is not flagged; codeql.yml is already correct. Both left untouched. --- .github/workflows/audit.yml | 4 ++++ .github/workflows/ci.yml | 3 +++ 2 files changed, 7 insertions(+) diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml index 74460f7..0eac258 100644 --- a/.github/workflows/audit.yml +++ b/.github/workflows/audit.yml @@ -11,6 +11,10 @@ on: jobs: audit: + permissions: + checks: write + contents: read + issues: write runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 06880ee..f77e08b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,6 +17,9 @@ on: env: CARGO_TERM_COLOR: always +permissions: + contents: read + jobs: check: name: Check