From ab9c8b8312dfa21aa9a4ba1facf8de8d806a3adc Mon Sep 17 00:00:00 2001 From: Benjamin Pracht Date: Tue, 25 Aug 2026 09:54:58 -0700 Subject: [PATCH] ci: set explicit GITHUB_TOKEN permissions on generate and test CodeQL flags workflows that rely on the default GITHUB_TOKEN permissions. These two predate the check, so nothing flagged them, but they carry the same exposure. release.yaml and slack-notifier.yaml already scope theirs. generate.yaml needs `contents: write` because add-and-commit pushes the regenerated output - the `contents: read` CodeQL suggests as a starting point would break it. buildtest.yaml only reads the checkout: its cache steps need no token scope, and golangci-lint-action only wants pull-requests: read for only-new-issues, which is not set. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/buildtest.yaml | 3 +++ .github/workflows/generate.yaml | 3 +++ 2 files changed, 6 insertions(+) diff --git a/.github/workflows/buildtest.yaml b/.github/workflows/buildtest.yaml index 87fe86b7d..396f0d343 100644 --- a/.github/workflows/buildtest.yaml +++ b/.github/workflows/buildtest.yaml @@ -21,6 +21,9 @@ on: pull_request: branches: [main] +permissions: + contents: read # Lint and test only read the checkout + jobs: test: runs-on: ubuntu-latest diff --git a/.github/workflows/generate.yaml b/.github/workflows/generate.yaml index a645ad528..976508793 100644 --- a/.github/workflows/generate.yaml +++ b/.github/workflows/generate.yaml @@ -19,6 +19,9 @@ on: push: branches-ignore: [main] +permissions: + contents: write # Required to commit the regenerated output + jobs: generate: runs-on: ubuntu-latest