From 63db4a9b496aa35e23e5c4c0b2748c5cb86fe47f Mon Sep 17 00:00:00 2001 From: Douglas Eichelberger Date: Fri, 24 Jul 2026 12:03:38 -0700 Subject: [PATCH] Restrict GITHUB_TOKEN permissions in CI workflow Resolves CodeQL alert actions/missing-workflow-permissions: the shared-config CI workflow only checks out code (with persist-credentials: false) and posts to a Slack webhook, neither of which needs write access, so contents: read is sufficient. --- .github/workflows/ci.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c1178ca..3f7565f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -8,5 +8,7 @@ on: jobs: call-workflow-from-shared-config: + permissions: + contents: read uses: rubyatscale/shared-config/.github/workflows/ci.yml@main secrets: inherit