This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch fix/build-yml-least-privilege-permissions in repository https://gitbox.apache.org/repos/asf/camel-kit.git
commit 9f287ee49ef184ced74c7cabc3bd6c6a9dc10757 Author: Andrea Cosentino <[email protected]> AuthorDate: Fri Oct 30 10:22:04 2026 +0100 Fix #136: set least-privilege permissions in build.yml Declare an explicit top-level permissions: contents: read so the build job runs with a least-privilege token instead of inheriting the repository default. The comment-pr job keeps its own pull-requests: write scope. Co-authored-by: Claude Opus 4.8 <[email protected]> --- .github/workflows/build.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 28d25333..e9e7704d 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -11,6 +11,11 @@ on: - main types: [opened, synchronize, reopened] +# Least-privilege default token; the build job only reads the repo. The comment-pr +# job raises its own scope to pull-requests: write. +permissions: + contents: read + jobs: build: name: Build and Test (Java ${{ matrix.java }})
