From a223cbb46474eee8bb88afaee4723fc7aefafac9 Mon Sep 17 00:00:00 2001 From: Ben Westgate Date: Fri, 25 Sep 2026 07:46:17 -0500 Subject: [PATCH] ci: Restrict master workflow permissions Declare contents: read for the two legacy master workflows flagged by CodeQL. This is a focused default-branch fix; reviewability-v1 already deletes pylint.yml and has PR #50 for its active test workflow.\n\nValidation: git diff --check. --- .github/workflows/pylint.yml | 3 +++ .github/workflows/python-package.yml | 3 +++ 2 files changed, 6 insertions(+) diff --git a/.github/workflows/pylint.yml b/.github/workflows/pylint.yml index d5cb1a4..96b1dda 100644 --- a/.github/workflows/pylint.yml +++ b/.github/workflows/pylint.yml @@ -2,6 +2,9 @@ name: Pylint on: [push] +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest diff --git a/.github/workflows/python-package.yml b/.github/workflows/python-package.yml index 8e29a31..8ed5f06 100644 --- a/.github/workflows/python-package.yml +++ b/.github/workflows/python-package.yml @@ -9,6 +9,9 @@ on: pull_request: branches: [ "master" ] +permissions: + contents: read + jobs: build: