From 496e866d8b66bf78f7a2c9ae76eaf7b7e2317f7b Mon Sep 17 00:00:00 2001 From: Paige Patton <64206430+paigerube14@users.noreply.github.com> Date: Fri, 29 May 2026 11:34:54 -0400 Subject: [PATCH] fix: add top-level read-all permissions to release workflow (#1366) Scorecard Token-Permissions check (alert #4) flags release.yml for missing top-level permissions, which means GITHUB_TOKEN defaults to broad write access across all jobs. Adding permissions: read-all at the top level enforces least privilege by default; the release job already declares contents: write at job level for the permissions it actually needs. Signed-off-by: Paige Patton Co-authored-by: Claude Sonnet 4.6 --- .github/workflows/release.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e43614e1..5ff35696 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -3,6 +3,9 @@ on: push: tags: - 'v*' + +permissions: read-all + jobs: release: permissions: