From 7a69220344b35f6901bd79a72420b9c6d539ee6f Mon Sep 17 00:00:00 2001 From: Jonas Konrad Date: Fri, 25 Sep 2026 17:28:33 +0200 Subject: [PATCH 1/2] Declare explicit GITHUB_TOKEN permissions in workflows Restrict the token to read-only repository contents. The docs workflow additionally needs pull-requests: write to comment the preview URL. Fixes #117 Co-Authored-By: Claude Opus 5.5 --- .github/workflows/build-all-and-publish.yml | 3 +++ .github/workflows/docs.yml | 5 +++++ .github/workflows/test.yml | 3 +++ 3 files changed, 11 insertions(+) diff --git a/.github/workflows/build-all-and-publish.yml b/.github/workflows/build-all-and-publish.yml index 1ea603bd..086d5fec 100644 --- a/.github/workflows/build-all-and-publish.yml +++ b/.github/workflows/build-all-and-publish.yml @@ -12,6 +12,9 @@ on: default: false type: boolean +permissions: + contents: read + jobs: linux: name: Linux natives (${{ matrix.arch }}) diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index d04c471b..84c513e9 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -10,6 +10,11 @@ on: type: string required: false +permissions: + contents: read + # Needed to comment the preview URL on the PR + pull-requests: write + jobs: build: name: Build documentation diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 3f2074d9..af54a9dc 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -4,6 +4,9 @@ on: push: pull_request: +permissions: + contents: read + jobs: linux: name: Linux test From 66c670051010f10279ce25fd810cc5db2b521371 Mon Sep 17 00:00:00 2001 From: Jonas Konrad Date: Fri, 25 Sep 2026 18:59:14 +0200 Subject: [PATCH 2/2] Clarify why docs.yml needs pull-requests: write Co-Authored-By: Claude Opus 5.5 --- .github/workflows/docs.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index da23661e..afec9a16 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -12,7 +12,8 @@ on: permissions: contents: read - # Needed to comment the preview URL on the PR + # Needed by the "Check PR"/"Comment on PR" steps, which post the preview URL + # when the workflow is dispatched from a non-main branch that has an open PR pull-requests: write jobs: