Merge pull request #20 from Strategic-Automation/codex/workflow-least-privilege-v2-0-2

Restrict GitHub Actions token permissions (v2.0.2)

.github/workflows/ci.yml

@@ -4,6 +4,9 @@ on:
   push:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     strategy:

.github/workflows/guard-check.yml

@@ -4,6 +4,10 @@ on:
     branches: [master, dev]
   pull_request:
     branches: [master, dev]
+
+permissions:
+  contents: read
+
 jobs:
   guard-check:
     runs-on: ubuntu-latest

.github/workflows/lint.yml

@@ -4,6 +4,10 @@ on:
     branches: [master]
   pull_request:
     branches: [master]
+
+permissions:
+  contents: read
+
 jobs:
   yaml-lint:
     runs-on: ubuntu-latest
@@ -30,4 +34,4 @@ jobs:
               sys.exit(1)
           else:
               print(f'All {len(files)} YAML files valid')
-          "
+          "

CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 2.0.2
+
+- Restricted all GitHub Actions workflow tokens to read-only repository contents, resolving the three least-privilege code-scanning alerts without changing workflow behavior.
+
 ## 2.0.1
 
 - Upgraded the pytest development dependency to 9.0.3 or later to address CVE-2025-71176 insecure temporary-directory handling.

distribution.yaml

@@ -1,6 +1,6 @@
 # violin - supervised agentic Hermes pentest profile
 name: violin
-version: 2.0.1
+version: 2.0.2
 description: "A supervised agentic Hermes penetration testing profile for authorised Kali/Parrot-based security assessment, reconnaissance, exploit validation, and reporting workflows."
 hermes_requires: ">=0.18.0"
 author: "Violin contributors"

plugins/violin_guard/plugin.yaml

@@ -1,5 +1,5 @@
 name: violin-guard
-version: "2.0.1"
+version: "2.0.2"
 description: Typed scope guards and an execute-and-record boundary with bounded synchronization windows.
 kind: standalone
 provides_tools:

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "violin"
-version = "2.0.1"
+version = "2.0.2"
 description = "Supervised agentic Hermes penetration-testing profile"
 requires-python = ">=3.11"
 dependencies = ["filelock>=3.13,<4"]

uv.lock

@@ -154,7 +154,7 @@ wheels = [
 
 [[package]]
 name = "violin"
-version = "2.0.1"
+version = "2.0.2"
 source = { virtual = "." }
 dependencies = [
     { name = "filelock" },