From 5f75436a63e7fb429372688455973e1c58c21f1e Mon Sep 17 00:00:00 2001 From: oumaymabout Date: Mon, 5 Oct 2026 15:43:50 +0200 Subject: [PATCH 1/2] fix(ci): add least-privilege permissions to GitHub Actions workflows Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/run_e2e.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/run_e2e.yaml b/.github/workflows/run_e2e.yaml index 370a02fbc..a879bcf77 100644 --- a/.github/workflows/run_e2e.yaml +++ b/.github/workflows/run_e2e.yaml @@ -6,6 +6,9 @@ on: branches: - master +permissions: + contents: read + jobs: tests: name: End-2-End tests From 37ac778d5f6430c05e01864ebd7745a827acb4d4 Mon Sep 17 00:00:00 2001 From: oumaymabout Date: Thu, 8 Oct 2026 21:09:16 +0200 Subject: [PATCH 2/2] ci: fix remaining Semgrep findings in GitHub Actions workflows Co-Authored-By: Claude Opus 5.5 --- .github/workflows/run_tests.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/run_tests.yaml b/.github/workflows/run_tests.yaml index 64969413f..9a1f5c9fe 100644 --- a/.github/workflows/run_tests.yaml +++ b/.github/workflows/run_tests.yaml @@ -6,6 +6,9 @@ on: branches: - master +permissions: + contents: read + jobs: tests: name: Unit tests and coverage @@ -24,7 +27,7 @@ jobs: - name: Convert coverage to lcov uses: jandelgado/gcov2lcov-action@2477d9ec11814a9326e7fdde8d315783d163edb7 # v1.0.8 - name: Coveralls - uses: coverallsapp/github-action@master + uses: coverallsapp/github-action@09b709cf6a16e30b0808ba050c7a6e8a5ef13f8d # v1.2.5 with: github-token: ${{ secrets.GITHUB_TOKEN }} path-to-lcov: coverage.lcov