This is an automated email from the ASF dual-hosted git repository.
sjanc pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/mynewt-core.git
The following commit(s) were added to refs/heads/master by this push:
new eb3d397bc ci: add explicit least-privilege permissions to CI workflows
eb3d397bc is described below
commit eb3d397bc03a248cead4e91f87217ce4d64016df
Author: Arpit Jain <[email protected]>
AuthorDate: Tue May 12 22:01:32 2026 +0900
ci: add explicit least-privilege permissions to CI workflows
Declare workflow-level permissions blocks on the CI workflows that
previously inherited the repository default GITHUB_TOKEN scope. Each
workflow only checks out code and runs build/test steps, so contents:
read is the minimum scope required. Documents intent explicitly and
removes reliance on org-default token grants.
Signed-off-by: Arpit Jain <[email protected]>
---
.github/workflows/build_all_apps.yml | 3 +++
.github/workflows/build_blinky.yml | 3 +++
.github/workflows/build_bootloader.yml | 3 +++
.github/workflows/build_bootloader_main.yml | 3 +++
.github/workflows/build_cc_target.yml | 3 +++
.github/workflows/build_targets.yml | 3 +++
.github/workflows/check_compliance.yml | 5 +++++
.github/workflows/newt_test_all.yml | 3 +++
.github/workflows/update_hw_ci_badges.yml | 4 ++++
9 files changed, 30 insertions(+)
diff --git a/.github/workflows/build_all_apps.yml
b/.github/workflows/build_all_apps.yml
index 47d09d9ab..f9bf574ec 100644
--- a/.github/workflows/build_all_apps.yml
+++ b/.github/workflows/build_all_apps.yml
@@ -21,6 +21,9 @@ name: Apps
on: [push, pull_request]
+permissions:
+ contents: read
+
jobs:
targets:
name: Build all apps
diff --git a/.github/workflows/build_blinky.yml
b/.github/workflows/build_blinky.yml
index a141cd153..1728066fb 100644
--- a/.github/workflows/build_blinky.yml
+++ b/.github/workflows/build_blinky.yml
@@ -21,6 +21,9 @@ name: Blinky
on: [push, pull_request]
+permissions:
+ contents: read
+
jobs:
blinky:
name: Build blinky
diff --git a/.github/workflows/build_bootloader.yml
b/.github/workflows/build_bootloader.yml
index 5a1fea8db..cc130020e 100644
--- a/.github/workflows/build_bootloader.yml
+++ b/.github/workflows/build_bootloader.yml
@@ -21,6 +21,9 @@ name: Bootloader
on: [push, pull_request]
+permissions:
+ contents: read
+
jobs:
bootloader:
name: Build bootloader
diff --git a/.github/workflows/build_bootloader_main.yml
b/.github/workflows/build_bootloader_main.yml
index a4d6257f9..74d1fdb7d 100644
--- a/.github/workflows/build_bootloader_main.yml
+++ b/.github/workflows/build_bootloader_main.yml
@@ -26,6 +26,9 @@ on:
schedule:
- cron: 42 0 * * *
+permissions:
+ contents: read
+
jobs:
bootloader:
name: Build bootloader (main)
diff --git a/.github/workflows/build_cc_target.yml
b/.github/workflows/build_cc_target.yml
index eff7ff674..1bd62d1a3 100644
--- a/.github/workflows/build_cc_target.yml
+++ b/.github/workflows/build_cc_target.yml
@@ -21,6 +21,9 @@ name: GCC target
on: [push, pull_request]
+permissions:
+ contents: read
+
jobs:
targets:
name: Build GCC test target
diff --git a/.github/workflows/build_targets.yml
b/.github/workflows/build_targets.yml
index 4ee19b93a..6f9965024 100644
--- a/.github/workflows/build_targets.yml
+++ b/.github/workflows/build_targets.yml
@@ -21,6 +21,9 @@ name: Targets
on: [push, pull_request]
+permissions:
+ contents: read
+
jobs:
targets:
name: Build all test targets
diff --git a/.github/workflows/check_compliance.yml
b/.github/workflows/check_compliance.yml
index 8ef9dbab6..d91a0af7e 100644
--- a/.github/workflows/check_compliance.yml
+++ b/.github/workflows/check_compliance.yml
@@ -23,6 +23,11 @@ on:
pull_request:
types: [opened, synchronize, reopened, labeled, unlabeled]
+permissions:
+ contents: read
+ issues: read
+ pull-requests: read
+
jobs:
style_check:
diff --git a/.github/workflows/newt_test_all.yml
b/.github/workflows/newt_test_all.yml
index c5ef6314d..0b38456f0 100644
--- a/.github/workflows/newt_test_all.yml
+++ b/.github/workflows/newt_test_all.yml
@@ -21,6 +21,9 @@ name: Unit tests
on: [push, pull_request]
+permissions:
+ contents: read
+
jobs:
newt_test:
name: Run newt test all
diff --git a/.github/workflows/update_hw_ci_badges.yml
b/.github/workflows/update_hw_ci_badges.yml
index c4a5a2ef3..bbc824e5c 100644
--- a/.github/workflows/update_hw_ci_badges.yml
+++ b/.github/workflows/update_hw_ci_badges.yml
@@ -23,6 +23,10 @@ on:
schedule:
- cron: '0 5 * * *'
+permissions:
+ contents: write
+ pull-requests: write
+
jobs:
update-badges:
runs-on: ubuntu-latest
