From 29a738423349b75d40732f4cd12a5a0326e03fed Mon Sep 17 00:00:00 2001 From: Ankur <114933665+AKjangid99@users.noreply.github.com> Date: Mon, 10 Aug 2026 17:09:43 +0530 Subject: [PATCH] ci: scope GitHub Actions permissions to least privilege (#6028) Co-authored-by: Ankur Jangid Co-authored-by: Daniel Imms <2193314+Tyriar@users.noreply.github.com> --- .github/workflows/ci.yml | 3 +++ .github/workflows/codeql-analysis.yml | 5 +++++ .github/workflows/copilot-setup-steps.yml | 3 +++ 3 files changed, 11 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8ee387965..04b5c2fd6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,6 +6,9 @@ on: pull_request: branches: [ "master" ] +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 3d7d26519..d8b336fe9 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -8,6 +8,11 @@ on: schedule: - cron: '41 17 * * 0' +permissions: + actions: read + contents: read + security-events: write + jobs: analyze: name: Analyze diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml index 1afefc1c1..b2b69533b 100644 --- a/.github/workflows/copilot-setup-steps.yml +++ b/.github/workflows/copilot-setup-steps.yml @@ -9,6 +9,9 @@ on: paths: - .github/workflows/copilot-setup-steps.yml +permissions: + contents: read + jobs: copilot-setup-steps: runs-on: ubuntu-latest