From 53553f406bf62b839c626e2378ed2aae2e006144 Mon Sep 17 00:00:00 2001 From: Arpit Jain Date: Tue, 26 May 2026 08:11:44 +0900 Subject: [PATCH] ci(lint-and-built): cap GITHUB_TOKEN to contents: read Workflow runs checks only; no GitHub API writes. Post-CVE-2025-30066 hardening pattern. Signed-off-by: Arpit Jain --- .github/workflows/lint-and-built.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/lint-and-built.yml b/.github/workflows/lint-and-built.yml index d655617f3..822034569 100644 --- a/.github/workflows/lint-and-built.yml +++ b/.github/workflows/lint-and-built.yml @@ -10,6 +10,9 @@ on: - '*' workflow_dispatch: +permissions: + contents: read + jobs: build-translation: runs-on: ubuntu-latest