ci: declare explicit GitHub token permissions#38

Merged

devkoriel merged 1 commit into

mainfrom

security/explicit-github-token-permissions-20260509

May 9, 2026

Contributor

devkoriel commented May 9, 2026

Summary

add explicit least-privilege GITHUB_TOKEN permissions before the org default is switched to read-only
keep write scopes limited to workflows that currently rely on default-token writes

Permission changes

.github/workflows/release.yml: contents: write (softprops/action-gh-release creates GitHub releases with GITHUB_TOKEN)

Verification

generated from the refreshed RFC-043 GitHub Actions token write-permission inventory
intended to preserve behavior after org-level default token permissions become read-only


          ci: declare GitHub token permissions for .github/workflows/release.yml

cf71a30

devkoriel merged commit 9922197 into main

4 of 5 checks passed

devkoriel deleted the security/explicit-github-token-permissions-20260509 branch

May 9, 2026 03:44

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet