From 97cc24eb7a347cc8f2c2be73686a6f23c3738843 Mon Sep 17 00:00:00 2001 From: Jared Lewis Date: Mon, 26 Oct 2026 10:04:44 +1100 Subject: [PATCH 1/3] ci: give ci-pass no token permissions --- .github/workflows/ci.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9379a5eb..8a51f3a7 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -135,6 +135,7 @@ jobs: # The only check the ruleset requires, so jobs can change without touching repo settings. ci-pass: if: always() + permissions: {} needs: - check-changelog - frontend From 8fc1e5f067d99a05638c13204fc3db6a33cb0fff Mon Sep 17 00:00:00 2001 From: Jared Lewis Date: Mon, 26 Oct 2026 10:23:12 +1100 Subject: [PATCH 2/3] docs(changelog): add 164 fragment --- changelog/164.trivial.md | 1 + 1 file changed, 1 insertion(+) create mode 100644 changelog/164.trivial.md diff --git a/changelog/164.trivial.md b/changelog/164.trivial.md new file mode 100644 index 00000000..5f39a38b --- /dev/null +++ b/changelog/164.trivial.md @@ -0,0 +1 @@ +Gave the `ci-pass` CI job no token permissions. From 88ae369304226a34723ddcd07cfe666e86191ae1 Mon Sep 17 00:00:00 2001 From: Jared Lewis Date: Mon, 26 Oct 2026 11:40:19 +1100 Subject: [PATCH 3/3] ci: limit the workflow token to read access --- .github/workflows/ci.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8a51f3a7..6e4ceeb8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,6 +6,9 @@ on: branches: [main] tags: ['v*'] +permissions: + contents: read + pull-requests: read jobs: check-changelog: