From 40cbd509f52fdd53f28e84f8591dec7b5bd39b93 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Thu, 1 Oct 2026 16:49:19 +0000 Subject: [PATCH] fix: grant test workflows read-only GITHUB_TOKEN permissions The pull request and master test workflows did not set a permissions block, so the token used the repository default. They only need to read the checkout. Co-authored-by: David --- .github/workflows/on-push-master.yml | 4 ++++ .github/workflows/pull-request-tests.yml | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/.github/workflows/on-push-master.yml b/.github/workflows/on-push-master.yml index ed28c4195..021c9b810 100644 --- a/.github/workflows/on-push-master.yml +++ b/.github/workflows/on-push-master.yml @@ -3,6 +3,10 @@ on: push: branches: - master + +permissions: + contents: read + jobs: test: name: Unit and Integration Tests diff --git a/.github/workflows/pull-request-tests.yml b/.github/workflows/pull-request-tests.yml index 798b57da1..d36124b75 100644 --- a/.github/workflows/pull-request-tests.yml +++ b/.github/workflows/pull-request-tests.yml @@ -3,6 +3,10 @@ on: pull_request: branches: - master + +permissions: + contents: read + jobs: test: name: Run Tests