Satoshi Qazi Muhammed fba1989e0f ci: give every workflow an explicit least-privilege GITHUB_TOKEN ...

CodeQL actions/missing-workflow-permissions: auto-approve.yml, auto-merge.yml, lock.yml, pr-any.yml, push-master.yml had no permissions block, so their jobs received the repository default token. Read-only where nothing writes through GITHUB_TOKEN; lock-threads gets the issues/pull-requests/discussions write it documents; workflows that write do it with a separate bot or app token, so GITHUB_TOKEN stays read-only.

2026-10-20 22:29:31 +04:00

..

workflows

ci: give every workflow an explicit least-privilege GITHUB_TOKEN

2026-10-20 22:29:31 +04:00

dependabot.yml

ci: let Dependabot keep the workflow actions current

2026-10-09 08:09:23 +04:00