[ci] Explicitly declare permissions and limit credentials (#15324)

Authored by: bashonly
2026-09-03 07:30:34 +00:00 · 2025-12-19 13:22:23 -06:00
parent 825648a740
commit a6a8f6b6d6
13 changed files with 96 additions and 43 deletions
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -9,6 +9,8 @@ on:
  schedule:
    - cron: '59 11 * * 5'

+permissions: {}
+
 jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
@@ -26,6 +28,8 @@ jobs:
    steps:
    - name: Checkout repository
      uses: actions/checkout@v6
+      with:
+        persist-credentials: false

    - name: Initialize CodeQL
      uses: github/codeql-action/init@v4