fix: set minimal top-level permissions on workflows (#14358)

- Fix CodeQL alerts by declaring read-only GITHUB_TOKEN scope at the workflow level. The codespace image publish workflow additionally needs packages: write to push to ghcr.io.
2026-05-04 17:56:25 +05:30
parent ea87610999
commit 2dee7457cd
9 changed files with 28 additions and 0 deletions
@@ -18,6 +18,9 @@ on:
 env:
  DOCKER_REPO: chatwoot/chatwoot

+permissions:
+  contents: read
+
 jobs:
  build:
    strategy: