From 2b403ddd775c724793f4ab5a49bea6225c75b72c Mon Sep 17 00:00:00 2001 From: Arpit Jain Date: Thu, 21 May 2026 11:00:36 +0900 Subject: [PATCH] ci: declare workflow-level contents: read on 3 lint/check workflows Three lint/check workflows (pr-target-branch, readme-linter, semantic) just validate PR metadata or markdown. No GitHub API writes from the workflows. Post-CVE-2025-30066 hardening shape (tj-actions/changed-files). yaml.safe_load validated on each touched file. Signed-off-by: Arpit Jain --- .github/workflows/pr-target-branch.yml | 3 +++ .github/workflows/readme-linter.yml | 3 +++ .github/workflows/semantic.yml | 3 +++ 3 files changed, 9 insertions(+) diff --git a/.github/workflows/pr-target-branch.yml b/.github/workflows/pr-target-branch.yml index 9a67f93b81a73..d13e1a810fbc6 100644 --- a/.github/workflows/pr-target-branch.yml +++ b/.github/workflows/pr-target-branch.yml @@ -7,6 +7,9 @@ on: - synchronize - edited +permissions: + contents: read + jobs: check-target-master: name: master diff --git a/.github/workflows/readme-linter.yml b/.github/workflows/readme-linter.yml index aaa5eaa6c0698..d3aa9588150ad 100644 --- a/.github/workflows/readme-linter.yml +++ b/.github/workflows/readme-linter.yml @@ -5,6 +5,9 @@ on: pull_request: branches: # Names of target branches, not source branches - master +permissions: + contents: read + jobs: run-readme-linter: runs-on: ubuntu-latest diff --git a/.github/workflows/semantic.yml b/.github/workflows/semantic.yml index ea869d99b4c54..03c011b2dab03 100644 --- a/.github/workflows/semantic.yml +++ b/.github/workflows/semantic.yml @@ -7,6 +7,9 @@ on: branches: - master +permissions: + contents: read + jobs: semantic: uses: influxdata/validate-semantic-github-messages/.github/workflows/semantic.yml@main