chore(ci): declare least-privilege permissions on the desktop e2e workflow - #6622

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 12, 2026 4:38pm

PR Summary

Low Risk
CI-only hardening that narrows token scope; no application or runtime behavior changes.

Overview
Adds a workflow-level permissions: contents: read block to .github/workflows/desktop-e2e.yml, matching other repo workflows and closing CodeQL “workflow does not contain permissions” findings.

Both jobs (e2e with pinned/electron@latest canary, and package-smoke) previously inherited the repository default GITHUB_TOKEN scope; read-only is enough for checkout, Bun/Playwright runs, and failure artifact uploads.

^{Reviewed by Cursor Bugbot for commit bf4241c. Configure here.}

Greptile Summary

This PR applies least-privilege token access to the manually dispatched desktop E2E workflow.

• Adds a workflow-level contents: read permission.
• Preserves sufficient access for repository checkout without granting unnecessary write scopes.

Confidence Score: 5/5

The PR appears safe to merge with no actionable issues identified.

The workflow only needs read access to check out repository contents, while its remaining setup, test, packaging, and artifact operations do not require broader GITHUB_TOKEN repository permissions.

_{Reviews (1): Last reviewed commit: "chore(ci): declare least-privilege permi..." | Re-trigger Greptile}