From 28258ec76e89c0f662019ae87e860c3796fe77e9 Mon Sep 17 00:00:00 2001 From: maziggy Date: Wed, 10 Jun 2026 12:36:36 +0200 Subject: [PATCH] ci(windows-installer): add explicit permissions block Address CodeQL actions/missing-workflow-permissions finding. Least- privilege at workflow level: contents: write is required by softprops/action-gh-release to attach the installer .exe to a tag release; all other steps are read-only. --- .github/workflows/windows-installer.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/windows-installer.yml b/.github/workflows/windows-installer.yml index 9d14c8d84..1d5888d8f 100644 --- a/.github/workflows/windows-installer.yml +++ b/.github/workflows/windows-installer.yml @@ -16,6 +16,14 @@ on: - 'v*' workflow_dispatch: +# Least-privilege per CodeQL actions/missing-workflow-permissions. +# contents: write is required by softprops/action-gh-release to attach +# the .exe to a tag release; the manual-dispatch path doesn't trigger +# that step and could run with read-only, but a single workflow-level +# block keeps the surface auditable in one place. +permissions: + contents: write + jobs: build: runs-on: windows-latest