From 89fb6dce279631d32d87d5837a8ed1b82e39b0fd Mon Sep 17 00:00:00 2001 From: Liang-Chun Tsai Date: Tue, 18 Aug 2026 13:30:58 -0700 Subject: [PATCH] Fix workflow token permissions Declare read-only top-level permissions so future jobs cannot inherit broader repository defaults. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/code-quality.yml | 3 +++ .github/workflows/unit-tests.yml | 3 +++ 2 files changed, 6 insertions(+) diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml index 5c4d1d2..e65c983 100644 --- a/.github/workflows/code-quality.yml +++ b/.github/workflows/code-quality.yml @@ -6,6 +6,9 @@ on: pull_request: branches: [ main ] +permissions: + contents: read + jobs: code-quality: permissions: diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml index 7c9d1d3..b91147b 100644 --- a/.github/workflows/unit-tests.yml +++ b/.github/workflows/unit-tests.yml @@ -4,6 +4,9 @@ on: pull_request: branches: [main] +permissions: + contents: read + jobs: unit-tests: permissions: