From eb05a5442ecdf3f569a8c354d3b75050b3ed5e7e Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 20 Jul 2026 11:36:20 +0000 Subject: [PATCH] ci: scope validate-openapi workflow token to read-only The Spectral lint job only checks out code and lints specs, but the workflow had no explicit permissions block, so it ran with the repo's default GITHUB_TOKEN permissions instead of least privilege. Mirrors the explicit scoping already done in deploy-docs.yml. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_015xoMDDaRCQ738YjJkxkteX --- .github/workflows/validate-openapi.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/validate-openapi.yml b/.github/workflows/validate-openapi.yml index aff3346..8336290 100644 --- a/.github/workflows/validate-openapi.yml +++ b/.github/workflows/validate-openapi.yml @@ -14,6 +14,9 @@ on: - '.spectral.yaml' - '.github/workflows/validate-openapi.yml' +permissions: + contents: read + jobs: spectral: name: Lint with Spectral