rick/LEDMatrix
1
0
Fork 0
mirror of https://github.com/ChuckBuilds/LEDMatrix.git synced 2026-08-01 16:58:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

ci: restrict the test workflow's GITHUB_TOKEN to contents:read

Browse Source 
CodeQL flagged the new unit-tests job for running with the default
unrestricted token; the pre-existing job had the same exposure. Both
jobs only check out the repo and run pytest, so a workflow-level
contents:read is sufficient.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FgbA8SMutQQpXkMG8LMmC4
This commit is contained in:
Claude
2026-08-01 14:16:51 +00:00
parent 1a0792225b
commit 64e8f87f86
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/test.yml
+4
View File
@@ -5,6 +5,10 @@ on:
push: push:
branches: [main] branches: [main]
# Both jobs only check out the repo and run pytest.
permissions:
contents: read
jobs: jobs:
plugin-safety: plugin-safety:
name: Plugin safety harness + unit tests name: Plugin safety harness + unit tests