From d1b4606350d19bd32d105d2fb0503bd77ac04d87 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lucas=20Garc=C3=ADa=20de=20Viedma=20P=C3=A9rez?=
 <72617878+Lucasgvdii@users.noreply.github.com>
Date: Tue, 11 Aug 2026 00:26:07 +0200
Subject: [PATCH] ci: restrict GITHUB_TOKEN to contents:read in the chkit-py
 publish workflow

Addresses the CodeQL 'workflow does not contain permissions' finding:
without an explicit block, jobs inherit the repo-default token scope.
The publish job keeps its own id-token:write block for OIDC.
---
 .github/workflows/publish-chkit-py.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/publish-chkit-py.yml b/.github/workflows/publish-chkit-py.yml
index b713a29e..cb7c8a42 100644
--- a/.github/workflows/publish-chkit-py.yml
+++ b/.github/workflows/publish-chkit-py.yml
@@ -9,6 +9,11 @@ on:
     tags:
       - "chkit-py-v*"
 
+# Minimal default for every job; the publish job overrides with the
+# id-token permission OIDC needs.
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest