Scoped GITEA_TOKEN to least privilege in Gitea Actions workflows.

2026-04-22 12:28:58 -04:00
parent 8c209e2bb3
commit 69714e59fa
3 changed files with 10 additions and 0 deletions
@@ -8,6 +8,9 @@ on:
  pull_request:
    paths: [uv.lock]

+permissions:
+  contents: read
+
 jobs:
  audit:
    name: Dependencies
@@ -5,6 +5,10 @@ on:
    branches: [master]
    tags: ["v*"]

+permissions:
+  contents: read
+  # packages: write  # not yet supported by Gitea
+
 jobs:
  build:
    name: Build
@@ -4,6 +4,9 @@ on:
  push:
  pull_request:

+permissions:
+  contents: read
+
 jobs:
  formatting:
    name: Formatting