Token-Permissions

[osyniakov]

The automated GITHUB_TOKEN is over-privileged by default.

The fix involves explicitly defining the minimum required permissions for the GITHUB_TOKEN at the workflow level, and then overriding them at the job level only when necessary.

[osyniakov]

This issue has been successfully resolved by defining least-privilege scopes in our workflows.

A special thank you to @guilload for the quick approvals and support in getting this security improvement merged.

Closing this out.

[guilload]

so, pip install --user pipenv==2025.0.4 did the trick?

[osyniakov]

so, pip install --user pipenv==2025.0.4 did the trick?

That's another issue, which is still open. I added an update here #5937 (comment).