From 64e8f87f86c03d16fd4449fd8a34d3fc661a6a88 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 1 Aug 2026 14:16:51 +0000 Subject: [PATCH] ci: restrict the test workflow's GITHUB_TOKEN to contents:read CodeQL flagged the new unit-tests job for running with the default unrestricted token; the pre-existing job had the same exposure. Both jobs only check out the repo and run pytest, so a workflow-level contents:read is sufficient. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01FgbA8SMutQQpXkMG8LMmC4 --- .github/workflows/test.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 96dd020b..fd982e2f 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -5,6 +5,10 @@ on: push: branches: [main] +# Both jobs only check out the repo and run pytest. +permissions: + contents: read + jobs: plugin-safety: name: Plugin safety harness + unit tests