From 80d09f7d466db23a30c325b76fee1179ba8af49c Mon Sep 17 00:00:00 2001 From: "Jose I. Paris" Date: Wed, 28 Oct 2026 17:22:40 +0100 Subject: [PATCH] ci: limit the default token permissions in release and scorecards Replace the workflow-level read-all permissions with contents: read. The jobs that need more permissions already set them at job level. Refs: PFM-8051 Assisted-by: Claude Code Signed-off-by: Jose I. Paris Chainloop-Trace-Sessions: 6ef5e9f5-dc0c-45cf-8b3f-70d112a87b7e --- .github/workflows/release.yaml | 3 ++- .github/workflows/scorecards.yml | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 0ab583438..25a21b16c 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -6,7 +6,8 @@ on: - "v*.*.*" # https://github.com/ossf/scorecard/blob/7ed886f1bd917d19cb9d6ce6c10e80e81fa31c39/docs/checks.md#token-permissions -permissions: read-all +permissions: + contents: read jobs: release_gate: diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index a46959ad4..40f469b30 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -15,7 +15,8 @@ on: branches: ["main"] # Declare default permissions as read only. -permissions: read-all +permissions: + contents: read jobs: chainloop_init: