Commit `bd2db1e4f2`

bd2db1e4f291908f059073876b2a0121e737abd6

parent: b133f75ada

Unsigned

cmc <hello@cleberg.net> · 2026-07-16 00:52 UTC

ci: constrain GITHUB_TOKEN to contents: read

The workflow set no permissions, so GITHUB_TOKEN inherited the repository
default — read-write for repositories created before February 2023. Flagged by
CodeQL as actions/missing-workflow-permissions (CWE-275).

Checkout only reads the repo and xcodebuild uses no token, so contents: read
covers the job. upload-artifact authenticates with the separate runtime token
and is unaffected.

Layout: unified · split

.github/workflows/test.yml +5

		@@ -9,6 +9,11 @@ on:
9	9	pull_request:
10	10	workflow_dispatch:
11	11
	12	# Without this, GITHUB_TOKEN inherits the repository default, which is
	13	# read-write for anything created before February 2023. The job only reads code.
	14	permissions:
	15	contents: read
	16
12	17	concurrency:
13	18	group: tests-${{ github.ref }}
14	19	cancel-in-progress: true

Commit bd2db1e4f2

Commit `bd2db1e4f2`