From 3506bbeb30fa8bbe8a4aac5f86c4023c42dd650f Mon Sep 17 00:00:00 2001 From: Arpit Jain Date: Mon, 25 May 2026 12:14:55 +0900 Subject: [PATCH] ci: declare workflow-level contents: read on chart-test and helm-test Both workflows just run helm chart tests; no GitHub API writes. contents: read at workflow level is the right cap. Post-CVE-2025-30066 hardening pattern. yaml.safe_load validated. Signed-off-by: Arpit Jain --- .github/workflows/chart-test.yml | 3 +++ .github/workflows/helm-test.yaml | 3 +++ 2 files changed, 6 insertions(+) diff --git a/.github/workflows/chart-test.yml b/.github/workflows/chart-test.yml index 529412e..dfd4d51 100644 --- a/.github/workflows/chart-test.yml +++ b/.github/workflows/chart-test.yml @@ -9,6 +9,9 @@ on: - cron: "0 2 * * *" workflow_dispatch: +permissions: + contents: read + jobs: discover: runs-on: ubuntu-latest diff --git a/.github/workflows/helm-test.yaml b/.github/workflows/helm-test.yaml index c848801..029c4b0 100644 --- a/.github/workflows/helm-test.yaml +++ b/.github/workflows/helm-test.yaml @@ -8,6 +8,9 @@ on: pull_request: branches: [ main ] +permissions: + contents: read + jobs: helm-unittest: runs-on: ubuntu-latest