Harden GitHub workflow permissions

- Restrict release workflow defaults to read-only access - Grant `id-token` only to the publish job - Document safe handling for `pull_request_target` in PR size checks

Julius Marminge committed 6 months agov0.0.24-nightly.20260513.277

Commit 556c4241 parent 7e20b232 files · +8 −2Browse files

Showing the changes to .github (2 of 2 files). Show all

Unified · Split

2 files

.github/workflows/pr-size.yml +3 −0
.github/workflows/release.yml +5 −2

.github/workflows/pr-size.yml+3−0

       group: pr-size-${{ github.event.pull_request.number }}
       cancel-in-progress: true
     steps:
+      # This pull_request_target job may fetch untrusted PR commits only as passive
+      # git data. Do not add dependency installs, build/test scripts, or cache
+      # actions here; use pull_request plus workflow_run for that pattern instead.
       - name: Checkout base repository
         uses: actions/checkout@v4
         with:

.github/workflows/release.yml+5−2

         type: string
 permissions:
-  contents: write
+  contents: read
-  id-token: write
+  id-token: none
 jobs:
   check_changes:
     if: ${{ !failure() && !cancelled() && needs.preflight.result == 'success' && needs.build.result == 'success' }}
     runs-on: ubuntu-24.04 # blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 10
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: Checkout
         uses: actions/checkout@v6