From b851c931a53b3c5314f8f5c20a2bea46d2247b8f Mon Sep 17 00:00:00 2001 From: Malushka Daspute Date: Wed, 5 Aug 2026 14:05:39 +0530 Subject: [PATCH 1/2] fix: Add explicit permissions to GitHub Actions workflows --- .github/workflows/build-test-coverage.yml | 3 +++ .github/workflows/build-test-release.yml | 3 +++ .github/workflows/repolinter.yml | 5 +++++ 3 files changed, 11 insertions(+) diff --git a/.github/workflows/build-test-coverage.yml b/.github/workflows/build-test-coverage.yml index 5992ee1..9d49aba 100644 --- a/.github/workflows/build-test-coverage.yml +++ b/.github/workflows/build-test-coverage.yml @@ -2,6 +2,9 @@ name: Build Test & Coverage on: [pull_request, push] +permissions: + contents: read + jobs: test: diff --git a/.github/workflows/build-test-release.yml b/.github/workflows/build-test-release.yml index 4fe90ee..4428116 100644 --- a/.github/workflows/build-test-release.yml +++ b/.github/workflows/build-test-release.yml @@ -3,6 +3,9 @@ on: release: types: [published] +permissions: + contents: read + jobs: release: diff --git a/.github/workflows/repolinter.yml b/.github/workflows/repolinter.yml index acb921f..ff01576 100644 --- a/.github/workflows/repolinter.yml +++ b/.github/workflows/repolinter.yml @@ -8,10 +8,15 @@ name: Repolinter Action # filtered in the "Test Default Branch" step. on: [push, workflow_dispatch] +permissions: read-all + jobs: repolint: name: Run Repolinter runs-on: ubuntu-latest + permissions: + contents: read + issues: write steps: - name: Test Default Branch id: default-branch From 51c66d6ae3313e93d5ac4687690bdb9465dd3d24 Mon Sep 17 00:00:00 2001 From: Malushka Daspute Date: Wed, 5 Aug 2026 14:42:57 +0530 Subject: [PATCH 2/2] fix: Use PyPI installer for Codecov to bypass GPG verification failure --- .github/workflows/build-test-coverage.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/build-test-coverage.yml b/.github/workflows/build-test-coverage.yml index 9d49aba..83188e3 100644 --- a/.github/workflows/build-test-coverage.yml +++ b/.github/workflows/build-test-coverage.yml @@ -30,6 +30,7 @@ jobs: with: token: ${{ secrets.CODECOV_TOKEN }} fail_ci_if_error: true + use_pypi: true code-style: name: Code style