From fe36ff8475c94bc8e7b0619d3e5bc687c419864c Mon Sep 17 00:00:00 2001 From: Arpit Jain Date: Mon, 25 May 2026 12:17:54 +0900 Subject: [PATCH] ci: declare workflow-level contents: read on compile-check and todos-check Both workflows are PR-time checks (compile sanity, todo comment validation). No GitHub API writes from the workflows. Post-CVE-2025-30066 hardening shape. yaml.safe_load validated. Signed-off-by: Arpit Jain --- .github/workflows/compile-check.yml | 3 +++ .github/workflows/todos-check.yml | 3 +++ 2 files changed, 6 insertions(+) diff --git a/.github/workflows/compile-check.yml b/.github/workflows/compile-check.yml index 1cf45e07dc0e2..ff6c704550d17 100644 --- a/.github/workflows/compile-check.yml +++ b/.github/workflows/compile-check.yml @@ -32,6 +32,9 @@ env: MAVEN_ARGS: --batch-mode --no-transfer-progress DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }} +permissions: + contents: read + jobs: compile-check: strategy: diff --git a/.github/workflows/todos-check.yml b/.github/workflows/todos-check.yml index fc33b12d3cb58..07342e13810f7 100644 --- a/.github/workflows/todos-check.yml +++ b/.github/workflows/todos-check.yml @@ -14,6 +14,9 @@ on: # allow manually run the action: workflow_dispatch: +permissions: + contents: read + jobs: todo-check: runs-on: ubuntu-latest