From 3aa779d7bd8864df75ad5a9854e2ac01e348af98 Mon Sep 17 00:00:00 2001 From: Arpit Jain Date: Thu, 14 May 2026 15:14:55 +0900 Subject: [PATCH 1/2] ci: declare contents:read on the lint job The lint job only runs eslint after checkout + setup-node. No GitHub API write. The block sits on the job rather than at workflow scope because the `test` job uses pkgjs/action's reusable node-test workflow, and adding a caller-level permissions block would intersect with the callee's grant. Style matches the workflow-level permissions block in commitlint.yml (contents:read) and release-please.yml (id-token:write + contents:read). Signed-off-by: Arpit Jain --- .github/workflows/nodejs.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/nodejs.yml b/.github/workflows/nodejs.yml index cf85f643..d49698a6 100644 --- a/.github/workflows/nodejs.yml +++ b/.github/workflows/nodejs.yml @@ -10,6 +10,8 @@ jobs: lint: name: Lint using ESLint runs-on: ubuntu-latest + permissions: + contents: read steps: - uses: actions/checkout@v6 - name: Use latest Node.js LTS From 263a4f564a2ad5e152bd50e48d94a986a141922b Mon Sep 17 00:00:00 2001 From: Arpit Jain Date: Wed, 8 Jul 2026 09:31:51 +0900 Subject: [PATCH 2/2] ci: move contents:read to workflow top level Per review, hoist the permissions block from the lint job to the workflow scope so it applies as the default for all jobs. Signed-off-by: Arpit Jain --- .github/workflows/nodejs.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/nodejs.yml b/.github/workflows/nodejs.yml index d49698a6..a92e8ea8 100644 --- a/.github/workflows/nodejs.yml +++ b/.github/workflows/nodejs.yml @@ -6,12 +6,13 @@ on: - main pull_request: +permissions: + contents: read + jobs: lint: name: Lint using ESLint runs-on: ubuntu-latest - permissions: - contents: read steps: - uses: actions/checkout@v6 - name: Use latest Node.js LTS