Scoped GITEA_TOKEN to least privilege in Gitea Actions workflows.

2026-04-22 22:00:32 -04:00
parent 867161adf1
commit 44069793f8
3 changed files with 10 additions and 0 deletions
@@ -9,6 +9,9 @@ on:
  pull_request:
    paths: [uv.lock]

+permissions:
+  contents: read
+
 jobs:
  audit:
    name: Dependencies
@@ -4,6 +4,10 @@ on:
  push:
    tags: ["v*"]

+permissions:
+  contents: read
+  # packages: write  # not yet supported by Gitea
+
 jobs:
  publish-package:
    name: Publish Package
@@ -5,6 +5,9 @@ on:
    branches: [master]
  pull_request:

+permissions:
+  contents: read
+
 jobs:
  formatting:
    name: Formatting