Merge pull request #637 from AIOSAI/dev

security(ci): least-privilege token on e2e-wheel workflow + W24 changelog (also carries playbook commit 6b89fcd)
2026-06-08 10:36:14 -07:00
parent e7d2d8c396 2e96ddc302
commit 1deb786c8a
6 changed files with 50 additions and 6 deletions
@@ -23,6 +23,11 @@ on:
      - "src/**"
  workflow_dispatch:

+# Least-privilege token (Scorecard Token-Permissions). This workflow only
+# reads the repo to build + smoke-test the wheel; it needs no write scopes.
+permissions:
+  contents: read
+
 jobs:
  e2e-wheel:
    name: e2e-wheel (${{ matrix.os }})