From cbee3b51d120695ad9da91017943ada9ace5240e Mon Sep 17 00:00:00 2001 From: Rhuan Barreto Date: Tue, 3 Mar 2026 21:07:14 +0100 Subject: [PATCH] fix(ci): add explicit permissions to workflows missing them Resolves code scanning alerts #1, #2, #3 (actions/missing-workflow-permissions) by adding `permissions: contents: read` to the three workflows that lacked a top-level permissions block, following the principle of least privilege. Co-Authored-By: Claude Opus 4.6 --- .github/workflows/code-pull-request.yml | 3 +++ .github/workflows/update-lock.yaml | 4 ++++ .github/workflows/windows-smoke-test.yml | 3 +++ 3 files changed, 10 insertions(+) diff --git a/.github/workflows/code-pull-request.yml b/.github/workflows/code-pull-request.yml index 211d47b0..7662fc9b 100644 --- a/.github/workflows/code-pull-request.yml +++ b/.github/workflows/code-pull-request.yml @@ -6,6 +6,9 @@ on: branches: - main +permissions: + contents: read + concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: true diff --git a/.github/workflows/update-lock.yaml b/.github/workflows/update-lock.yaml index 2592dce5..25e6d54a 100644 --- a/.github/workflows/update-lock.yaml +++ b/.github/workflows/update-lock.yaml @@ -6,9 +6,13 @@ on: paths: - "package.json" - ".github/workflows/update-lock.yaml" +permissions: + contents: read + concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: true + jobs: update-lock: name: Update Package Lock diff --git a/.github/workflows/windows-smoke-test.yml b/.github/workflows/windows-smoke-test.yml index 8bd6a943..904cf245 100644 --- a/.github/workflows/windows-smoke-test.yml +++ b/.github/workflows/windows-smoke-test.yml @@ -6,6 +6,9 @@ on: branches: - main +permissions: + contents: read + concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: true