From f8638be3826fb97994c35f69e93044d984d4f146 Mon Sep 17 00:00:00 2001 From: Douglas Eichelberger Date: Mon, 17 Aug 2026 12:06:50 -0700 Subject: [PATCH] Add explicit GITHUB_TOKEN permissions to CI Test workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CodeQL actions/missing-workflow-permissions (alert #3) flagged the `build` job in .github/workflows/build.yml, which had no effective permissions block and so inherited the repository default. The job only checks out the repo, installs Ruby and the bundle, and runs rspec — it writes nothing back to GitHub — so a workflow-level `contents: read` is the least privilege that keeps it working. Placed at the workflow level (matching push_gem.yml in this repo) since build.yml has a single job. push_gem.yml and standardrb.yaml already declare permissions and are not flagged; left untouched. --- .github/workflows/build.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index a2f15c0..6a1490a 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -1,5 +1,7 @@ name: CI Test on: [push, pull_request] +permissions: + contents: read jobs: build: name: Ruby ${{ matrix.ruby }}