From 9da54eff84751a2ad9340febb153ff61445728c5 Mon Sep 17 00:00:00 2001 From: Evan Rusackas Date: Wed, 17 Jun 2026 15:41:47 -0700 Subject: [PATCH] chore(ci): set least-privilege workflow permissions (zizmor) (#41161) Co-authored-by: Claude Opus 4.8 --- .github/workflows/superset-python-integrationtest.yml | 5 +++++ .github/workflows/superset-python-unittest.yml | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/.github/workflows/superset-python-integrationtest.yml b/.github/workflows/superset-python-integrationtest.yml index d57b300659e..92e2dc58954 100644 --- a/.github/workflows/superset-python-integrationtest.yml +++ b/.github/workflows/superset-python-integrationtest.yml @@ -1,6 +1,11 @@ # Python integration tests name: Python-Integration +# Least-privilege default for GITHUB_TOKEN. Jobs that need more (e.g. OIDC for +# codecov uploads) opt in via their own job-level `permissions:` block. +permissions: + contents: read + on: push: branches: diff --git a/.github/workflows/superset-python-unittest.yml b/.github/workflows/superset-python-unittest.yml index 7355005eb55..be18420bcba 100644 --- a/.github/workflows/superset-python-unittest.yml +++ b/.github/workflows/superset-python-unittest.yml @@ -1,6 +1,11 @@ # Python unit tests name: Python-Unit +# Least-privilege default for GITHUB_TOKEN. Jobs that need more (e.g. OIDC for +# codecov uploads) opt in via their own job-level `permissions:` block. +permissions: + contents: read + on: push: branches: