fix: set minimal top-level permissions on workflows (#14358)

- Fix CodeQL alerts by declaring read-only GITHUB_TOKEN scope at the workflow level. The codespace image publish workflow additionally needs packages: write to push to ghcr.io.
2026-05-04 17:56:25 +05:30
parent ea87610999
commit 2dee7457cd
9 changed files with 28 additions and 0 deletions
@@ -14,6 +14,9 @@ on:
    - cron: "0 0 * * *"
  workflow_dispatch:

+permissions:
+  contents: read
+
 jobs:
  nightly:
    runs-on: ubuntu-24.04