Updated .github/workflows/cleanup-ghcr.yml

2026-10-05 21:51:23 +02:00 · 2026-05-01 11:50:03 +02:00
parent 3407c5f088
commit 8dd4efa555
1 changed files with 6 additions and 0 deletions
@@ -19,6 +19,12 @@ on:
        type: boolean
        default: false

+# This workflow authenticates exclusively via GHCR_CLEANUP_TOKEN (a classic PAT)
+# and never reads/writes via the default GITHUB_TOKEN. Strip every permission
+# from the GITHUB_TOKEN so a stolen workflow run can't reach the repo at all
+# — least privilege per CodeQL `actions/missing-workflow-permissions`.
+permissions: {}
+
 jobs:
  cleanup:
    runs-on: ubuntu-latest