From 52c3dedb6c8fce9de72f811592462b63cac92fa1 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 17 Jul 2026 06:14:09 +0000
Subject: [PATCH] ci: add least-privilege permissions to workflows

Address CodeQL 'Workflow does not contain permissions' alerts by
declaring explicit GITHUB_TOKEN permissions.

- Add a top-level 'contents: read' default to both workflows so all
  jobs run read-only unless they opt into more.
- semantic-release: contents/issues/pull-requests write for release
  creation and PR/issue comments.
- binary: contents write to upload release assets.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012piXvDqsCcLoVenm2oVCUy
---
 .github/workflows/release.yaml | 10 ++++++++++
 .github/workflows/test.yaml    |  4 ++++
 2 files changed, 14 insertions(+)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 626a173..ff4f772 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -3,9 +3,17 @@ on:
   push:
     branches:
       - main
+
+permissions:
+  contents: read
+
 jobs:
   semantic-release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
     outputs:
       release-version: ${{ steps.semantic.outputs.release-version }}
       new-release-published: ${{ steps.semantic.outputs.new-release-published }}
@@ -18,6 +26,8 @@ jobs:
   binary:
     runs-on: ubuntu-latest
     needs: semantic-release
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
       - name: Install Go
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 6dc93b1..318a88b 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -5,6 +5,10 @@ on:
   push:
     branches:
       - main
+
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest