Restart closed merge request !153: Potential fix for code scanning alert no. 2: Workflow does not contain permissions at Restart / titanium

Restart
2026-03-19T09:35:44+00:00

Potential fix for https://github.com/RestartB/titanium/security/code-scanning/2

In general, the fix is to explicitly declare restricted GITHUB_TOKEN permissions for the workflow (or per-job) instead of relying on inherited defaults. For a Ruff linting workflow that only reads code and dependencies, contents: read is sufficient and aligns with CodeQL’s suggested minimal starting point.

The best way to fix this specific file without changing existing functionality is to add a permissions block at the top workflow level, right after the name: Ruff line (before on:). This will apply to all jobs in the workflow (currently only check) and set the token to read-only for repository contents. No other permissions appear necessary, since the job only checks out code, sets up Python, installs tools/dependencies, and runs Ruff. No extra imports or dependencies are needed; this is a pure YAML configuration change in .github/workflows/ruff.yml.

Concretely:

Edit .github/workflows/ruff.yml.

Insert:

permissions:
contents: read

between line 1 (name: Ruff) and line 3 (on:), shifting the subsequent lines down.

Leave the rest of the workflow unchanged.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.