From 25b801b5a15a4edc8065319240ae0aa76bbc2b01 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 17 Jul 2026 05:57:37 +0000
Subject: [PATCH] ci: add explicit permissions to GitHub Actions workflows

Resolve CodeQL 'Workflow does not contain permissions' alerts by adding
a restrictive top-level `permissions: contents: read` default to each
workflow, following the principle of least privilege.

Jobs requiring more than read access get explicit job-level grants:
- build-and-test.yml: test job needs packages: read to pull the image
- helm.yml: security-scan needs security-events: write to upload SARIF

Existing job-level permissions (packages: write, contents: write) are
left unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01G7v75WdVmg6AFyTWCpWjX1
---
 .github/workflows/build-and-test.yml | 6 ++++++
 .github/workflows/helm.yml           | 6 ++++++
 .github/workflows/release.yml        | 3 +++
 .github/workflows/test.yml           | 3 +++
 4 files changed, 18 insertions(+)

diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
index 950f487..35ebdc2 100644
--- a/.github/workflows/build-and-test.yml
+++ b/.github/workflows/build-and-test.yml
@@ -12,6 +12,9 @@ env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository_owner }}/postgres
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -72,6 +75,9 @@ jobs:
   test:
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
     strategy:
       fail-fast: false # Don't cancel other tests if one fails
       matrix:
diff --git a/.github/workflows/helm.yml b/.github/workflows/helm.yml
index 64c25c1..29930b3 100644
--- a/.github/workflows/helm.yml
+++ b/.github/workflows/helm.yml
@@ -21,6 +21,9 @@ env:
   REGISTRY: ghcr.io
   HELM_REGISTRY: oci://ghcr.io/flanksource/charts
 
+permissions:
+  contents: read
+
 jobs:
   lint-and-test:
     runs-on: ubuntu-latest
@@ -91,6 +94,9 @@ jobs:
 
   security-scan:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 41c8bb0..15f2dd8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,6 +17,9 @@ env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository_owner }}/postgres
 
+permissions:
+  contents: read
+
 jobs:
   determine-version:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b270e50..1ddbec0 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -14,6 +14,9 @@ env:
   TEST_USER: testuser
   TEST_PASSWORD: testpass123
 
+permissions:
+  contents: read
+
 jobs:
   test-env-variables:
     runs-on: ubuntu-latest