Skip to content

ci: scope ci workflow token to contents: read#233

Merged
rafaelfranca merged 1 commit into
rails:masterfrom
arpitjain099:chore/workflow-permissions
Jun 2, 2026
Merged

ci: scope ci workflow token to contents: read#233
rafaelfranca merged 1 commit into
rails:masterfrom
arpitjain099:chore/workflow-permissions

Conversation

@arpitjain099

@arpitjain099 arpitjain099 commented Jun 2, 2026

Copy link
Copy Markdown
Contributor

This narrows the GITHUB_TOKEN for .github/workflows/ci.yml to read-only.

  • These jobs only check out the repo and run build/test steps, so contents: read covers them.
  • Without an explicit block the token inherits the repo default, often write-enabled.
  • Following the principle of least privilege from the GitHub Actions security hardening guide.

Behavior is unchanged.

@arpitjain099
ci: scope ci workflow token to contents: read
1d45543 
Set an explicit least-privilege permissions block so the workflow GITHUB_TOKEN is scoped to contents: read instead of inheriting the repository default.

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
@rafaelfranca rafaelfranca merged commit f45c346 into rails:master Jun 2, 2026
23 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@arpitjain099 @rafaelfranca