[DONT MERGE] Seismic => upstream diff

[cdrappi]

No description provided.

In general, the fix is to add an explicit permissions: block that restricts the GITHUB_TOKEN to the minimum required scope. Since these jobs only need to read the repository source, setting contents: read at the workflow root is an appropriate baseline. If any job later requires broader permissions, it can define its own permissions: section that overrides the root for that job only.

The single best way to fix this without changing existing behavior is:

• Add a root‑level permissions: block after the on: block (before concurrency:) in .github/workflows/seismic.yml.
• Set contents: read, which is sufficient for actions/checkout and typical CI tasks that don’t push or modify GitHub resources.
• Do not modify any job definitions or steps, since none of them currently rely on write permissions.

Concretely, in .github/workflows/seismic.yml, between line 7 (the last line of the on: section) and line 9 (the start of concurrency:), insert:

permissions:
  contents: read

No additional imports, methods, or definitions are required; this is pure workflow configuration.

In general, the fix is to add an explicit permissions block to the workflow (at the top level under name / on) or to individual jobs, granting only the minimal scopes needed. Since all shown jobs only read code and external resources and do not write back to the repository or PRs, the safest baseline is contents: read. If other jobs (like viem or contract-tests) later need more, they can override permissions per job.

The single best fix with minimal functional change is to add a root-level permissions block right after the name: Seismic CI line. This will apply to all jobs that don’t define their own permissions and will satisfy CodeQL’s requirement for explicit scoping of GITHUB_TOKEN. Based on the visible steps (checkout, toolchain setup, caching, HTTP requests, builds, tests), contents: read is sufficient, and no other permissions (e.g., pull-requests: write, issues: write) are required. No additional imports or external libraries are needed, as this is a YAML configuration change only.

Concretely, in .github/workflows/seismic.yml, insert:

permissions:
  contents: read

between line 1 (name: Seismic CI) and line 3 (on:). This documents and enforces minimal read-only access for the GITHUB_TOKEN across all jobs, including the build job at line 29 that CodeQL flagged.

To fix this, add an explicit permissions block that limits the default GITHUB_TOKEN scope to what the workflow actually needs. Since the jobs only check out code and run builds/tests, they require only read access to repository contents (and possibly packages, though nothing here explicitly uses packages via the GitHub API). The simplest and safest change is to set workflow‑wide permissions to contents: read, which each job will inherit unless overridden.

Concretely, in .github/workflows/seismic.yml, insert a permissions: section near the top at the workflow level (between on: and concurrency: or after name: is standard). This block should specify contents: read. No other code or steps need to change, and no additional methods or imports are required, because this is purely a YAML configuration adjustment for GitHub Actions.

To fix this, add an explicit permissions block that limits the GITHUB_TOKEN to read‑only repository contents (and other scopes only if needed). The simplest and safest approach here is to set permissions at the workflow root so that it applies to all jobs (rustfmt, build, clippy, test, viem, etc.), since none of them appear to need write access. A minimal starting point is:

permissions:
  contents: read

This should be inserted near the top level of .github/workflows/seismic.yml, alongside on:, concurrency:, and env:. No other functionality changes are required because the jobs only read the code and run local tooling. If, elsewhere in the truncated viem job (lines 92–142), there were actions that needed writes (e.g., commenting on PRs), they could later override permissions per job; but based on the visible snippet, a workflow‑wide contents: read is appropriate.

Concretely:

• Edit .github/workflows/seismic.yml.
• After the on: block (lines 3–7), or before concurrency:, add a new top‑level permissions: section:
  • contents: read.

No imports or additional methods are needed, since this is GitHub Actions YAML configuration only.