Claude 64e8f87f86 ci: restrict the test workflow's GITHUB_TOKEN to contents:read ...

CodeQL flagged the new unit-tests job for running with the default
unrestricted token; the pre-existing job had the same exposure. Both
jobs only check out the repo and run pytest, so a workflow-level
contents:read is sufficient.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FgbA8SMutQQpXkMG8LMmC4

2026-08-01 14:16:51 +00:00

..

claude-code-review.yml

Add Claude Code GitHub Workflow (#377)

2026-06-29 14:30:41 -04:00

claude.yml

Add Claude Code GitHub Workflow (#377)

2026-06-29 14:30:41 -04:00

test.yml

ci: restrict the test workflow's GITHUB_TOKEN to contents:read

2026-08-01 14:16:51 +00:00