From 4fe0ec7867fa92b65943d2b5cafc6f9107e38606 Mon Sep 17 00:00:00 2001 From: gsidhwani-nr Date: Wed, 20 May 2026 15:08:01 +0530 Subject: [PATCH] Add explicit permissions to GitHub Actions workflows Resolves CodeQL code-scanning alerts for missing workflow permissions (actions/missing-workflow-permissions). Adds least-privilege permissions to release.yml and repolinter.yml to comply with security best practices. Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/release.yml | 5 ++++- .github/workflows/repolinter.yml | 4 ++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 910a8a7..0284335 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,8 +1,11 @@ name: Build and Release (Manual Run JDK 21) v1.4 -on: +on: workflow_dispatch: # This event allows manual triggering +permissions: + contents: write + env: THIRD_PARTY_GIT_AUTHOR_EMAIL: opensource+bot@newrelic.com THIRD_PARTY_GIT_AUTHOR_NAME: nr-opensource-bot diff --git a/.github/workflows/repolinter.yml b/.github/workflows/repolinter.yml index 063e748..29525f3 100644 --- a/.github/workflows/repolinter.yml +++ b/.github/workflows/repolinter.yml @@ -8,6 +8,10 @@ name: Repolinter Action # filtered in the "Test Default Branch" step. on: [push, workflow_dispatch] +permissions: + contents: read + issues: write + jobs: repolint: name: Run Repolinter