fix: set minimal top-level permissions on workflows (#14358)

- Fix CodeQL alerts by declaring read-only GITHUB_TOKEN scope at the workflow level. The codespace image publish workflow additionally needs packages: write to push to ghcr.io.
2026-05-04 17:56:25 +05:30
parent ea87610999
commit 2dee7457cd
9 changed files with 28 additions and 0 deletions
@@ -8,6 +8,9 @@ on:
    branches:
      - develop

+permissions:
+  contents: read
+
 jobs:
  test:
    runs-on: ubuntu-22.04