From 98342d4aecb5fefaf8581c484186bf5f6d87d344 Mon Sep 17 00:00:00 2001 From: Mariano Abad Date: Tue, 28 Jul 2026 09:58:12 -0300 Subject: [PATCH] drm: bound the GITHUB_TOKEN in the drm workflow CodeQL flagged the new workflow for not declaring permissions, which is fair: every job here only checks out, builds and tests, and the artifact up/download in the deb job authenticates with the runtime token rather than this one, so contents: read is the whole requirement. Declared at the workflow level so the reusable bridge workflow it calls inherits the same bound. The stock workflows do not declare it either, but they are upstream's and this feature does not touch them; a new file can start out right. --- .github/workflows/drm-capture.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/drm-capture.yml b/.github/workflows/drm-capture.yml index e79d9aa65..db62bd48d 100644 --- a/.github/workflows/drm-capture.yml +++ b/.github/workflows/drm-capture.yml @@ -1,5 +1,11 @@ name: DRM capture (opt-in drm feature) +# Least-privilege GITHUB_TOKEN. Every job here only checks out, builds and tests; the artifact +# up/download used by the deb job authenticates with the runtime token, not this one. Declared at +# the workflow level so the reusable bridge workflow called below inherits the same bound. +permissions: + contents: read + # Everything CI-side about the opt-in `drm` backend lives here, so the stock CI and release workflows # stay byte-identical to a build with the feature off. Nothing in this file runs unless a drm-related # path changes (or someone dispatches it by hand), so a PR that does not touch the backend pays nothing.