From 613e76aec687e6d287ce800050b47e027be61819 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20Gonz=C3=A1lez=20Fern=C3=A1ndez?= Date: Wed, 22 Jul 2026 10:33:35 +0200 Subject: [PATCH] ci(live-ebsi): pin least-privilege GITHUB_TOKEN permissions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CodeQL alert #1 (actions/missing-workflow-permissions): live-ebsi.yml was the only workflow without an explicit permissions block, so its token inherited the repository-wide default. Practical exposure was already low — the repo default is read-only, there is no pull_request trigger, and the job only checks out, installs and runs pytest against the live registries without touching the GitHub API. Pinned anyway because this is the one unattended, scheduled workflow: an explicit block keeps it read-only regardless of a later change to the default. CI-only, the published artifact is unchanged: no CHANGELOG entry and no release (same as #126 / PR #132). Closes #137 --- .github/workflows/live-ebsi.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/live-ebsi.yml b/.github/workflows/live-ebsi.yml index d5cc349..609a7fc 100644 --- a/.github/workflows/live-ebsi.yml +++ b/.github/workflows/live-ebsi.yml @@ -9,6 +9,13 @@ on: - cron: "17 6 * * 1" # Mondays 06:17 UTC workflow_dispatch: +# Least privilege: this job only checks out and runs pytest against the live +# registries — it never touches the GitHub API. Explicit here (not inherited) +# so the one unattended, scheduled workflow stays read-only regardless of the +# repository-wide default. +permissions: + contents: read + jobs: live: name: Resolve a real DID against pilot