oscerd opened a new pull request, #141: URL: https://github.com/apache/camel-kit/pull/141
Closes #136. Adds an explicit top-level `permissions: contents: read` to `.github/workflows/build.yml`. The `build` job only reads the repository, so it no longer inherits the repository-default token scope; the `comment-pr` job keeps its own `pull-requests: write`. This clears zizmor's `excessive-permissions` findings on the workflow. **Scope note:** the `cache-poisoning` advisory (Maven cache on `pull_request`) is a separate, non-exploitable concern — GitHub isolates fork-PR cache scopes and the build job writes nothing with the token — and is intentionally left out of this minimal change. Validated with `actionlint` (clean) and `zizmor` (`excessive-permissions` cleared). _AI-generated by Claude Code (Claude Opus 4.8) on behalf of @oscerd._ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
