From ea561907db1fc4bc40fa4f77aac11be55943d1c3 Mon Sep 17 00:00:00 2001 From: Myles Scolnick Date: Tue, 14 Jul 2026 16:45:29 -0400 Subject: [PATCH] ci: adopt deny-all top-level workflow permissions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Set each workflow's top-level `permissions:` to `{}` (deny-all) and move the previously top-level grants into the specific jobs that inherited them. Effective permissions are unchanged for every job — this makes the grants explicit per job so a newly-added job can't silently inherit broad scopes. Flagged by github-maintenance Workflow Permissions Audit. --- .github/workflows/bump-lockfile.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/bump-lockfile.yml b/.github/workflows/bump-lockfile.yml index ddc7a98..afd55d6 100644 --- a/.github/workflows/bump-lockfile.yml +++ b/.github/workflows/bump-lockfile.yml @@ -1,8 +1,6 @@ name: Update lockfiles -permissions: - contents: write - pull-requests: write +permissions: {} on: workflow_dispatch: @@ -35,3 +33,6 @@ jobs: labels: pixi delete-branch: true add-paths: pixi.lock + permissions: + contents: write + pull-requests: write