From ecaa3b8f80dfa409e66705f49f98cee2b32e13ae Mon Sep 17 00:00:00 2001 From: Korinne Adler Date: Tue, 29 Sep 2026 12:22:42 -0500 Subject: [PATCH] ci: Add explicit workflow permissions --- .github/workflows/ci.yml | 3 +++ .github/workflows/semantic-pull-requests.yml | 3 +++ .github/workflows/stale.yml | 4 ++++ 3 files changed, 10 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 92cfc5f8..f4f21089 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,6 +6,9 @@ on: pull_request: branches: [ master ] +permissions: + contents: read + jobs: build: diff --git a/.github/workflows/semantic-pull-requests.yml b/.github/workflows/semantic-pull-requests.yml index 819fd017..7ee0cb3b 100644 --- a/.github/workflows/semantic-pull-requests.yml +++ b/.github/workflows/semantic-pull-requests.yml @@ -6,6 +6,9 @@ on: - edited - synchronize +permissions: + contents: read + jobs: main: runs-on: ubuntu-latest diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index 82ffc897..3543f370 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -4,6 +4,10 @@ on: schedule: - cron: "0 0 * * *" +permissions: + contents: read + issues: write + jobs: stale: