From fd87b1cce28d13dc133e6eac872476e8c533dd05 Mon Sep 17 00:00:00 2001 From: SatoshiQaziMuhammed Date: Wed, 21 Oct 2026 13:39:02 +0400 Subject: [PATCH] ci: read-only GITHUB_TOKEN for backend and frontend CI (#13) CodeQL actions/missing-workflow-permissions #1-#3: neither workflow writes through GITHUB_TOKEN (checkout, toolchain, cache, upload-artifact). --- .github/workflows/backend-ci.yml | 5 +++++ .github/workflows/frontend-ci.yml | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/.github/workflows/backend-ci.yml b/.github/workflows/backend-ci.yml index 1fd0451..e76502f 100644 --- a/.github/workflows/backend-ci.yml +++ b/.github/workflows/backend-ci.yml @@ -16,6 +16,11 @@ on: env: CARGO_TERM_COLOR: always + +# Read-only token: no step writes through GITHUB_TOKEN. +permissions: + contents: read + jobs: check: runs-on: ubuntu-latest diff --git a/.github/workflows/frontend-ci.yml b/.github/workflows/frontend-ci.yml index 6976b59..e3d0639 100644 --- a/.github/workflows/frontend-ci.yml +++ b/.github/workflows/frontend-ci.yml @@ -13,6 +13,11 @@ on: - '.github/workflows/frontend-ci.yml' workflow_dispatch: + +# Read-only token: no step writes through GITHUB_TOKEN. +permissions: + contents: read + jobs: lint-and-test: runs-on: ubuntu-latest