Add permissions blocks to workflows that lack them #152
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This is a best practice and yamllint warns about omitting it.
We'd like to run GitHub Actions with the least possible permissions assigned to the token for security reasons. To make this possible, let's add a permissions block to each workflow that lacks one.
There was a problem hiding this comment.
Pull request overview
This PR enhances the security posture of GitHub Actions workflows by implementing the principle of least privilege through explicit permissions blocks. It also adds YAML document headers (---) as a best practice.
- Added
permissions: contents: readto test.yml and lint.yml workflows - Added YAML document headers (
---) to all three workflow files for yamllint compliance
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| .github/workflows/test.yml | Added YAML document header and read-only contents permission for test workflow |
| .github/workflows/release.yml | Added YAML document header (permissions already existed) |
| .github/workflows/lint.yml | Added YAML document header and read-only contents permission for linting workflow |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
spicythuna
approved these changes
Nov 21, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
We'd like to run GitHub Actions with the least possible permissions assigned to the token for security reasons. To make this possible, let's add a permissions block to each workflow that lacks one.
In addition, add the missing document header, since this is a best practice and yamllint warns about omitting it.
Fixes #151