diff options
| author | Yuriy Andamasov <yuriy@vyos.io> | 2026-05-11 01:20:33 +0300 |
|---|---|---|
| committer | Yuriy Andamasov <yuriy@vyos.io> | 2026-05-11 01:20:33 +0300 |
| commit | 6325cc9912f0ff4f73e582891398db9ed4f1392f (patch) | |
| tree | 5dad5748710aae5b6dd9a5749beb0538f58373e7 /docs/_static/css | |
| parent | 025319ead33f2d12c2bfb151a081ebed94f70730 (diff) | |
| download | vyos-documentation-6325cc9912f0ff4f73e582891398db9ed4f1392f.tar.gz vyos-documentation-6325cc9912f0ff4f73e582891398db9ed4f1392f.zip | |
ci(ai-validation): scope GitHub App token to permission-contents: read
The token is used only for read-only repo operations (sparse-checkout
of reviewer branches.json, full checkout of vyos-1x, download of the
reference-DB release asset). Without an explicit permission-* input
the token inherits all installation permissions. Scope it down so a
compromise cannot mutate either repo.
Surfaced by CodeRabbit on #1960; applied to all three branch copies
(rolling via #1969 follow-up + circinus #1959 + sagitta #1960) so the
workflow stays in sync across the version-train branches.
🤖 Generated by [robots](https://vyos.io)
Diffstat (limited to 'docs/_static/css')
0 files changed, 0 insertions, 0 deletions