36573901145
100%

Ran 29 Sep 2026 01:16PM UTC

Jobs 1

Files 1

Run time 1min

Badge

Embed ▾

Committed 29 Sep 2026 01:16PM UTC coverage: 100.0%. Remained the same

Build # 36573901145

Build Type

push

github

Committed by

web-flow

Commit Message

Limit GITHUB_TOKEN permissions in CI workflows (#104)

Add a workflow-level `permissions: contents: read` block to the coverage,
lint, and test workflows, which previously inherited the repository-default
GITHUB_TOKEN scopes. None of these jobs writes to the repository: they only
check out, set up Python, and run tox.

Also pass `persist-credentials: false` to every actions/checkout step so the
token is not left behind in .git/config. No workflow needs the credential
after checkout, and the release workflow's trusted publishing relies on OIDC
rather than the git credential.

Addresses the CodeQL actions/missing-workflow-permissions alerts reported in
#103, and the corresponding zizmor excessive-permissions and artipacked
audits.


Assisted-by: Claude Opus 5

Signed-off-by: Jim Garrison <garrison@ibm.com>

Coverage Stats

96 of 96 relevant lines covered (100.0%)

1.0 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	36573901145.1	29 Sep 2026 01:16PM UTC	1	100.0	GitHub Action Run

IBM / extremal-python-dependencies / 36573901145
100%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 36573901145

IBM / extremal-python-dependencies / 36573901145 100%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 36573901145

IBM / extremal-python-dependencies / 36573901145
100%

README BADGES
x