diff options
| author | Yuriy Andamasov <yuriy@vyos.io> | 2026-05-11 01:20:33 +0300 |
|---|---|---|
| committer | Yuriy Andamasov <yuriy@vyos.io> | 2026-05-11 01:20:33 +0300 |
| commit | 647db7d696b4c8285a9dd80be773aff7e9740840 (patch) | |
| tree | ff9a87e0459d8a34c7c9e0df1308988dc62d3759 /docs/_include/coverage | |
| parent | 8b5c867897bad4278b29b318b493f2ceee8015e0 (diff) | |
| download | vyos-documentation-647db7d696b4c8285a9dd80be773aff7e9740840.tar.gz vyos-documentation-647db7d696b4c8285a9dd80be773aff7e9740840.zip | |
ci(ai-validation): scope GitHub App token to permission-contents: read
The token is used only for read-only repo operations (sparse-checkout
of reviewer branches.json, full checkout of vyos-1x, download of the
reference-DB release asset). Without an explicit permission-* input
the token inherits all installation permissions. Scope it down so a
compromise cannot mutate either repo.
Surfaced by CodeRabbit on #1960; applied to all three branch copies
(rolling via #1969 follow-up + circinus #1959 + sagitta #1960) so the
workflow stays in sync across the version-train branches.
🤖 Generated by [robots](https://vyos.io)
Diffstat (limited to 'docs/_include/coverage')
0 files changed, 0 insertions, 0 deletions