From b891cf3af8dff1c2d737451ea6ec07d77ac1f10c Mon Sep 17 00:00:00 2001 From: Arpit Jain Date: Tue, 19 May 2026 07:35:01 +0900 Subject: [PATCH] ci: declare workflow-level contents: read The CI workflow runs npm install and npm test on PR and push to main. No GitHub API interaction beyond the checkout, so contents: read is sufficient at the workflow level. CVE-2025-30066 (tj-actions/changed-files compromise) is the recent reminder that any token granted at trigger time can be exfiltrated if a downstream action is compromised. Per-workflow permissions caps the blast radius. yaml.safe_load validated locally. Signed-off-by: Arpit Jain --- .github/workflows/main-ci.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/main-ci.yml b/.github/workflows/main-ci.yml index 14b19a6..6ad2ad9 100644 --- a/.github/workflows/main-ci.yml +++ b/.github/workflows/main-ci.yml @@ -8,6 +8,9 @@ on: branches: - main +permissions: + contents: read + jobs: job: runs-on: ubuntu-latest