From b6ae27a8fa7cd44ac69a7b70733c9124e9d23e3e Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 21 Jul 2026 09:30:27 +0000
Subject: [PATCH 1/2] Initial plan


From 9a27e22a041a89b87297651d88a1172f79aefbc0 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 21 Jul 2026 09:32:05 +0000
Subject: [PATCH 2/2] fix: add explicit permissions blocks to GitHub Actions
 workflows

Fixes CodeQL alerts #1, #2, #5, #50 (actions/missing-workflow-permissions).
Adds 'permissions: contents: read' to each job to restrict GITHUB_TOKEN
scope and follow the principle of least privilege.
---
 .github/workflows/docker-image.yml | 4 ++++
 .github/workflows/pylint.yml       | 2 ++
 .github/workflows/pytest.yml       | 2 ++
 3 files changed, 8 insertions(+)

diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
index 2b56ac01..8269a04d 100644
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -15,6 +15,8 @@ jobs:
   build:
     runs-on: ubuntu-latest
     #runs-on: self-hosted
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -74,6 +76,8 @@ jobs:
   merge:
     runs-on: ubuntu-latest
     #runs-on: self-hosted
+    permissions:
+      contents: read
     needs:
       - build
     steps:
diff --git a/.github/workflows/pylint.yml b/.github/workflows/pylint.yml
index 543772c2..9e949214 100644
--- a/.github/workflows/pylint.yml
+++ b/.github/workflows/pylint.yml
@@ -17,6 +17,8 @@ jobs:
   lint:
     #runs-on: self-hosted
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
         python-version: ["3.9", "3.10" , "3.11" , "3.12", "3.13"]
diff --git a/.github/workflows/pytest.yml b/.github/workflows/pytest.yml
index 0f4ccf41..0930fa08 100644
--- a/.github/workflows/pytest.yml
+++ b/.github/workflows/pytest.yml
@@ -9,6 +9,8 @@ on:
 jobs:
   test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix: