krz/hutch

an ios client for sourcehut

clone: git clone https://gitbay.org/krz/hutch.git

e2481a6ca0b063606e9b6cf2d86c51cec5d6abf0

verified · cmc

author: Christian Cleberg <hello@cleberg.net> · 2026-07-16T00:52:20Z

ci: constrain GITHUB_TOKEN to contents: read

The workflow set no permissions, so GITHUB_TOKEN inherited the repository
default — read-write for repositories created before February 2023. Flagged by
CodeQL as actions/missing-workflow-permissions (CWE-275).

Checkout only reads the repo and xcodebuild uses no token, so contents: read
covers the job. upload-artifact authenticates with the separate runtime token
and is unaffected.

 .github/workflows/test.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 568ff39..c992758 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -9,6 +9,11 @@ on:
   pull_request:
   workflow_dispatch:
 
+# Without this, GITHUB_TOKEN inherits the repository default, which is
+# read-write for anything created before February 2023. The job only reads code.
+permissions:
+  contents: read
+
 concurrency:
   group: tests-${{ github.ref }}
   cancel-in-progress: true