From b59fda8c3d22a6841169a94becce4af9c2d9e855 Mon Sep 17 00:00:00 2001 From: Pinecone Founding Engineer Date: Sat, 11 Jul 2026 16:13:31 -0400 Subject: [PATCH] ci: add least-privilege workflow permissions Resolves all 11 CodeQL actions/missing-workflow-permissions alerts. All four workflows are read-only; each only checks out the repo and runs notebooks or scripts with no GITHUB_TOKEN writes. Set contents: read. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/client-versions.yaml | 4 ++++ .github/workflows/pr.yaml | 4 ++++ .github/workflows/test-notebooks-all.yaml | 4 ++++ .github/workflows/test-notebooks-changed.yaml | 4 ++++ 4 files changed, 16 insertions(+) diff --git a/.github/workflows/client-versions.yaml b/.github/workflows/client-versions.yaml index 05be514b..03636ca9 100644 --- a/.github/workflows/client-versions.yaml +++ b/.github/workflows/client-versions.yaml @@ -4,6 +4,10 @@ on: workflow_dispatch: workflow_call: +# All jobs only read the checkout; no writes via GITHUB_TOKEN. +permissions: + contents: read + jobs: analyze-client-versions: runs-on: ubuntu-latest diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml index 43efd238..442e15e4 100644 --- a/.github/workflows/pr.yaml +++ b/.github/workflows/pr.yaml @@ -6,6 +6,10 @@ on: branches: - main +# All jobs only read the checkout; no writes via GITHUB_TOKEN. +permissions: + contents: read + jobs: lint: uses: './.github/workflows/lint.yaml' diff --git a/.github/workflows/test-notebooks-all.yaml b/.github/workflows/test-notebooks-all.yaml index 1ea2ded8..5d549aea 100644 --- a/.github/workflows/test-notebooks-all.yaml +++ b/.github/workflows/test-notebooks-all.yaml @@ -9,6 +9,10 @@ on: default: 'docs' type: string +# All jobs only read the checkout; no writes via GITHUB_TOKEN. +permissions: + contents: read + jobs: validate-notebooks: runs-on: ubuntu-latest diff --git a/.github/workflows/test-notebooks-changed.yaml b/.github/workflows/test-notebooks-changed.yaml index 68e1bdef..a09bba76 100644 --- a/.github/workflows/test-notebooks-changed.yaml +++ b/.github/workflows/test-notebooks-changed.yaml @@ -8,6 +8,10 @@ on: type: string default: 'main' +# All jobs only read the checkout; no writes via GITHUB_TOKEN. +permissions: + contents: read + jobs: validate-notebooks: runs-on: ubuntu-latest