From 7b76a85f45d0f2c4a5f9f51b4ee61a61dd2eecfb Mon Sep 17 00:00:00 2001 From: Roy Moore Date: Sun, 31 May 2026 09:31:57 +0300 Subject: [PATCH] ci: add explicit contents:read permissions to workflows Addresses 'Workflow does not contain permissions' security warning by declaring least-privilege GITHUB_TOKEN scopes for all CI workflows. Fixes #52 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/bandit.yml | 3 +++ .github/workflows/black.yml | 3 +++ .github/workflows/coverage.yml | 3 +++ .github/workflows/isort.yml | 3 +++ .github/workflows/mypy.yml | 3 +++ .github/workflows/pylint.yml | 3 +++ .github/workflows/pytest.yml | 3 +++ 7 files changed, 21 insertions(+) diff --git a/.github/workflows/bandit.yml b/.github/workflows/bandit.yml index 5341735..62c50fd 100644 --- a/.github/workflows/bandit.yml +++ b/.github/workflows/bandit.yml @@ -1,6 +1,9 @@ name: Bandit on: [ pull_request, workflow_dispatch ] +permissions: + contents: read + jobs: build: name: Bandit Validation diff --git a/.github/workflows/black.yml b/.github/workflows/black.yml index 95e126d..72fe384 100644 --- a/.github/workflows/black.yml +++ b/.github/workflows/black.yml @@ -1,6 +1,9 @@ name: Black on: [ pull_request, workflow_dispatch ] +permissions: + contents: read + jobs: build: name: Black Validation diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index 70dbfa8..9800609 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -1,6 +1,9 @@ name: Coverage on: [ pull_request, workflow_dispatch ] +permissions: + contents: read + jobs: build: name: Coverage Validation diff --git a/.github/workflows/isort.yml b/.github/workflows/isort.yml index 647a8da..3c63ad6 100644 --- a/.github/workflows/isort.yml +++ b/.github/workflows/isort.yml @@ -1,6 +1,9 @@ name: Isort on: [ pull_request, workflow_dispatch ] +permissions: + contents: read + jobs: build: name: Isort Validation diff --git a/.github/workflows/mypy.yml b/.github/workflows/mypy.yml index f737b09..8580209 100644 --- a/.github/workflows/mypy.yml +++ b/.github/workflows/mypy.yml @@ -1,6 +1,9 @@ name: Mypy on: [ pull_request, workflow_dispatch ] +permissions: + contents: read + jobs: build: name: Mypy Validation diff --git a/.github/workflows/pylint.yml b/.github/workflows/pylint.yml index 4a248e3..95296d7 100644 --- a/.github/workflows/pylint.yml +++ b/.github/workflows/pylint.yml @@ -1,6 +1,9 @@ name: Pylint on: [ pull_request, workflow_dispatch ] +permissions: + contents: read + jobs: build: name: Pylint Validation diff --git a/.github/workflows/pytest.yml b/.github/workflows/pytest.yml index 721eb29..1bdd29e 100644 --- a/.github/workflows/pytest.yml +++ b/.github/workflows/pytest.yml @@ -1,6 +1,9 @@ name: Pytest on: [ pull_request, workflow_dispatch ] +permissions: + contents: read + jobs: build: name: Pytest Validation