From 106ce12f75e30a50a58bcf7b44850bbec7d143b7 Mon Sep 17 00:00:00 2001
From: Thomas Schmitt <thomas.schmitt@uipath.com>
Date: Fri, 19 Jun 2026 10:11:47 +0300
Subject: [PATCH] Restrict access of each CI job

Apply minimum permissions for each CI job
---
 .github/workflows/ci.yaml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 84bab06..5dc9986 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -8,6 +8,8 @@ env:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       UIPATHCLI_VERSION: ${{ steps.version.outputs.UIPATHCLI_VERSION }}
     env:
@@ -43,6 +45,8 @@ jobs:
 
   test_linux:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -62,6 +66,8 @@ jobs:
 
   test_windows:
     runs-on: windows-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -75,6 +81,8 @@ jobs:
 
   test_macos:
     runs-on: macos-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -89,6 +97,7 @@ jobs:
   publish_pages:
     needs: [build, test_linux, test_windows, test_macos]
     permissions:
+      contents: read
       pages: write
       id-token: write
     if: github.ref == 'refs/heads/main'
@@ -118,6 +127,8 @@ jobs:
     needs: [build, test_linux, test_windows, test_macos]
     if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     env:
       UIPATHCLI_VERSION: ${{ needs.build.outputs.UIPATHCLI_VERSION }}
     steps: