SatoshiQaziMuhammed de9f5a8604 ci: give every workflow an explicit least-privilege GITHUB_TOKEN (#23) ...

CodeQL actions/missing-workflow-permissions: auto-approve.yml, auto-merge.yml, lock.yml, pr-any.yml, push-master.yml had no permissions block, so their jobs received the repository default token. Read-only where nothing writes through GITHUB_TOKEN; lock-threads gets the issues/pull-requests/discussions write it documents; workflows that write do it with a separate bot or app token, so GITHUB_TOKEN stays read-only.

2026-10-20 23:00:29 +04:00

..

auto-approve.yml

ci: give every workflow an explicit least-privilege GITHUB_TOKEN (#23)

2026-10-20 23:00:29 +04:00

auto-merge.yml

ci: give every workflow an explicit least-privilege GITHUB_TOKEN (#23)

2026-10-20 23:00:29 +04:00

codeql.yml

Add CodeQL analysis workflow configuration

2026-01-08 02:13:58 +03:00

lock.yml

ci: give every workflow an explicit least-privilege GITHUB_TOKEN (#23)

2026-10-20 23:00:29 +04:00

pr-any.yml

ci: give every workflow an explicit least-privilege GITHUB_TOKEN (#23)

2026-10-20 23:00:29 +04:00

push-master.yml

ci: give every workflow an explicit least-privilege GITHUB_TOKEN (#23)

2026-10-20 23:00:29 +04:00