From 829e0ec653a64dd5f6911c558ce1e9231793ef8c Mon Sep 17 00:00:00 2001 From: Adnan Khan Date: Mon, 20 Oct 2025 22:56:19 -0400 Subject: [PATCH 1/2] Scope down GitHub token permissions for update_snapshot.yml --- .github/workflows/update_snapshot.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/update_snapshot.yml b/.github/workflows/update_snapshot.yml index d682e7e..d423029 100644 --- a/.github/workflows/update_snapshot.yml +++ b/.github/workflows/update_snapshot.yml @@ -6,6 +6,10 @@ on: branches: - 'dependabot/**' + +permissions: + contents: write + jobs: update: runs-on: ubuntu-latest From 24a101334a98689e57162f4cd547260837ae3afc Mon Sep 17 00:00:00 2001 From: Adnan Khan Date: Mon, 20 Oct 2025 22:56:24 -0400 Subject: [PATCH 2/2] Scope down GitHub token permissions for build.yml --- .github/workflows/build.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 122df57..6a3e127 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -5,6 +5,10 @@ on: - main workflow_dispatch: pull_request: + +permissions: + contents: read + jobs: Build-and-Test-CDK: runs-on: ubuntu-latest