From 82be04bdfab701b390521913231c51cce4ae37eb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?L=C3=A9on=20Avic=20Simmons?= <Avicennasis@gmail.com>
Date: Sun, 5 Jul 2026 19:41:00 -0400
Subject: [PATCH] chore(security): default-deny top-level permissions in
 codeql.yml

Scorecard Token-Permissions alert #9: the workflow relied on the repo
default token grant. Top-level is now contents:read; the analyze job
re-grants exactly what CodeQL needs.
---
 .github/workflows/codeql.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index ad75e6c..1a66310 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -8,6 +8,11 @@ on:
   schedule:
     - cron: "0 6 * * 1"
 
+# Default-deny at the top level (Scorecard Token-Permissions); the
+# analyze job below re-grants exactly what CodeQL needs.
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Analyze