From 5dde327dd409d2acdebd85e7b9768f4d9d964857 Mon Sep 17 00:00:00 2001 From: woksin Date: Fri, 23 Oct 2026 11:13:33 +0200 Subject: [PATCH] Declare token permissions in the dependency update workflow Both jobs push with the default token from push-with-retry.sh and relied on the repository's write default. Grant contents: write to those jobs only, read elsewhere. --- .github/workflows/update-dependencies.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/update-dependencies.yml b/.github/workflows/update-dependencies.yml index 2371fb24..d41cd37a 100644 --- a/.github/workflows/update-dependencies.yml +++ b/.github/workflows/update-dependencies.yml @@ -15,11 +15,16 @@ concurrency: group: update-dependencies cancel-in-progress: false +permissions: + contents: read + jobs: update-nuget: name: Update NuGet Packages runs-on: ubuntu-latest + permissions: + contents: write # push-with-retry.sh pushes the update commit to main timeout-minutes: 35 steps: - name: Checkout repository @@ -71,6 +76,8 @@ jobs: update-npm: name: Update npm Packages runs-on: ubuntu-latest + permissions: + contents: write # push-with-retry.sh pushes the update commit to main timeout-minutes: 30 steps: - name: Checkout repository