From 872e63b6426d145049b47d677439b2e45d3b49a9 Mon Sep 17 00:00:00 2001 From: MacOS Date: Wed, 29 Jul 2026 10:58:36 +0200 Subject: [PATCH 1/3] build(build-workflow): set all permissions to none --- .github/workflows/build.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 265b05f2..8cb3a106 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -10,6 +10,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +# Set all permissions to none +permissions: {} + jobs: # `allTests` used to run in a single job alongside `assemble`. On a 7 GB # ubuntu-latest runner the combined peak RSS (Gradle JVM + Kotlin daemon + From 2ff76b595ebac60a21ad13656ce8dd5f0b9c3f28 Mon Sep 17 00:00:00 2001 From: MacOS Date: Wed, 29 Jul 2026 11:01:13 +0200 Subject: [PATCH 2/3] build(build-workflow): set contents permission to read for job test --- .github/workflows/build.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 8cb3a106..8ea7af11 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -39,6 +39,10 @@ jobs: tasks: jsTest wasmJsTest wasmWasiTest - name: native tasks: linuxX64Test + + permissions: + contents: read + steps: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 From a8058af5f84a442554f58b9811af659f9ae9a687 Mon Sep 17 00:00:00 2001 From: MacOS Date: Wed, 29 Jul 2026 11:08:55 +0200 Subject: [PATCH 3/3] build(build-workflow): set contents permission to read for job assemble --- .github/workflows/build.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 8ea7af11..911bef87 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -42,7 +42,7 @@ jobs: permissions: contents: read - + steps: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -108,6 +108,10 @@ jobs: name: assemble runs-on: ubuntu-latest timeout-minutes: 40 + + permissions: + contents: read + steps: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1