Skip to content

Revert "fix: Add explicit permissions to workflow"#40

Open
alichtman wants to merge 1 commit intomainfrom
revert-39-fix/add-explicit-permissions-to-workflow
Open

Revert "fix: Add explicit permissions to workflow"#40
alichtman wants to merge 1 commit intomainfrom
revert-39-fix/add-explicit-permissions-to-workflow

Conversation

@alichtman
Copy link
Copy Markdown
Contributor

Reverts #39.

Context: #39 (comment)

@meta-cla meta-cla bot added the CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. label Mar 22, 2026
@ghost
Copy link
Copy Markdown

ghost commented Mar 22, 2026

Reverts #39.

Context: #39 (comment)

This change is mainly about explicitly defining GITHUB_TOKEN permissions to follow least privilege. Since no permissions are set, the workflow inherits the repo default (which can be read-write for older repos), so this makes it more explicit and avoids unnecessary access.

It also resolves the 3 "Workflow does not contain permissions" code scanning alert:

Agree that some warnings can come from outdated actions, but this one is specifically about missing permissions rather than action versions. Let me know if you'd prefer tightening this further (example: contents: read only).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant