Commit `bd2db1e4f2`

bd2db1e4f291908f059073876b2a0121e737abd6

parent: b133f75ada

Unsigned

cmc <hello@cleberg.net> · 2026-07-16 00:52 UTC

ci: constrain GITHUB_TOKEN to contents: read

The workflow set no permissions, so GITHUB_TOKEN inherited the repository
default — read-write for repositories created before February 2023. Flagged by
CodeQL as actions/missing-workflow-permissions (CWE-275).

Checkout only reads the repo and xcodebuild uses no token, so contents: read
covers the job. upload-artifact authenticates with the separate runtime token
and is unaffected.

Layout: unified · split

.github/workflows/test.yml +5

   pull_request:
   workflow_dispatch:
+# Without this, GITHUB_TOKEN inherits the repository default, which is
+# read-write for anything created before February 2023. The job only reads code.
+permissions:
+  contents: read
 concurrency:
   group: tests-${{ github.ref }}
   cancel-in-progress: true

Commit bd2db1e4f2

Commit `bd2db1e4f2`