From ac74f5144fc92852a6be42e766b371c1534edf25 Mon Sep 17 00:00:00 2001 From: Adnan Khan Date: Tue, 21 Oct 2025 15:28:59 -0400 Subject: [PATCH 1/2] ci: scope down permissions for update_snapshot.yml --- .github/workflows/update_snapshot.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/update_snapshot.yml b/.github/workflows/update_snapshot.yml index d682e7e..025c5be 100644 --- a/.github/workflows/update_snapshot.yml +++ b/.github/workflows/update_snapshot.yml @@ -6,6 +6,9 @@ on: branches: - 'dependabot/**' +permissions: + contents: write + jobs: update: runs-on: ubuntu-latest From 992b36f87da0dc8cfb2061b4d22b3a5310658ea9 Mon Sep 17 00:00:00 2001 From: Adnan Khan Date: Tue, 21 Oct 2025 15:29:01 -0400 Subject: [PATCH 2/2] ci: scope down permissions for build.yml --- .github/workflows/build.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 122df57..1994acd 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -5,6 +5,9 @@ on: - main workflow_dispatch: pull_request: +permissions: + contents: read + jobs: Build-and-Test-CDK: runs-on: ubuntu-latest