ci: declare GITHUB_TOKEN scope explicitly for three workflows (#40520)
distributions.yml and modern-distributions.yml only check out the repo and run python validators, so they get contents: read. winget.yml runs on release: published and forwards a precomputed artifact URL to wingetcreate using the WINGET_TOKEN secret (an external token). It does not checkout the repo and does not call any GitHub API endpoint, so it gets permissions: {} (no scopes needed). This brings the three workflows in line with the other workflows in this repo that already declare explicit permissions. Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
Arpit Jain committed
May 29, 2026 at 08:50 UTC
946f2809f9d5c580f6e1d6220273983b743e1a51
3 files changed
+10
-2
.github/workflows/distributions.yml
+5
-2
@@ -1,9 +1,12 @@
1
name: Validate distributions
2
3
-on:
4
- pull_request:
3
+on:
4
+ pull_request:
5
paths: ['distributions/**']
6
7
+permissions:
8
+ contents: read
9
+
10
jobs:
11
check:
12
name: Validate distributions
.github/workflows/modern-distributions.yml
+3
@@ -4,6 +4,9 @@ on:
4
pull_request:
5
paths: ['distributions/**']
6
7
+permissions:
8
+ contents: read
9
+
10
jobs:
11
check:
12
name: Validate tar based distributions changes
.github/workflows/winget.yml
+2
@@ -4,6 +4,8 @@ on:
4
release:
5
types: [released]
6
7
+permissions: {}
8
+
9
jobs:
10
publish:
11
if: github.event.release.prerelease == false