From 54a3589c27e6a303dbf274e277bfa12324e52b93 Mon Sep 17 00:00:00 2001 From: Chris Coutinho Date: Sat, 13 Jun 2026 18:37:10 +0200 Subject: [PATCH] ci(pact): scope record-deployment token at job level Move 'permissions: contents: read' from workflow level to the record-deployment job (GitHub Actions least-privilege, rule S8264), keeping this workflow uniform with the astrolabe copy. Single-job workflow, but consistent and future-proof. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/pact-record-deployment.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/pact-record-deployment.yml b/.github/workflows/pact-record-deployment.yml index 84ee58a3..14840bcd 100644 --- a/.github/workflows/pact-record-deployment.yml +++ b/.github/workflows/pact-record-deployment.yml @@ -28,9 +28,6 @@ on: tags: - "v*" -permissions: - contents: read - # A re-tag (e.g. after a botched release) could push the same/overlapping tag # twice; don't cancel an in-flight recording — let it complete. concurrency: @@ -46,6 +43,9 @@ jobs: record-deployment: name: Record production deployment runs-on: ubuntu-latest + # Least-privilege: scope the token at job level (GitHub Actions S8264). + permissions: + contents: read timeout-minutes: 5 steps: - name: Join tailnet