From f2b896be5a064b6d6c2a9daa25944f634ed29727 Mon Sep 17 00:00:00 2001 From: igerber Date: Sun, 26 Apr 2026 08:12:07 -0400 Subject: [PATCH] chore(ci): declare workflow-level permissions on publish.yml Add `permissions: contents: read` at workflow level so the four build jobs (build-linux, build-macos-arm, build-windows, build-sdist) have explicit GITHUB_TOKEN scoping instead of inheriting from repo defaults. The publish job's per-job `permissions: id-token: write` block remains unchanged. Per-job permissions replace (not merge with) workflow-level, so that job retains only id-token: write (it doesn't checkout, so it doesn't need contents access). Clears 4 CodeQL `actions/missing-workflow-permissions` warnings without changing runtime token scope (repo default was already `read`). Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/publish.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 630c3531..ded5f0d0 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -4,6 +4,9 @@ on: release: types: [published] +permissions: + contents: read + jobs: # Build wheels on Linux using manylinux containers build-linux: