fix: set minimal top-level permissions on workflows (#14358)

- Fix CodeQL alerts by declaring read-only GITHUB_TOKEN scope at the workflow level. The codespace image publish workflow additionally needs packages: write to push to ghcr.io.
2026-05-04 17:56:25 +05:30
parent ea87610999
commit 2dee7457cd
9 changed files with 28 additions and 0 deletions
@@ -7,6 +7,9 @@ on:
      - master
  workflow_dispatch:

+permissions:
+  contents: read
+
 jobs:
  test-build:
    strategy: