- Restrict release workflow defaults to read-only access - Grant `id-token` only to the publish job - Document safe handling for `pull_request_target` in PR size checks
Showing the changes to .github (2 of 2 files). Show all
Unified · Split
| @@ -124,6 +124,9 @@ jobs: · 123 unmodified lines | ||
| 124 | 124 | group: pr-size-${{ github.event.pull_request.number }} |
| 125 | 125 | cancel-in-progress: true |
| 126 | 126 | steps: |
| 127 | + # This pull_request_target job may fetch untrusted PR commits only as passive | |
| 128 | + # git data. Do not add dependency installs, build/test scripts, or cache | |
| 129 | + # actions here; use pull_request plus workflow_run for that pattern instead. | |
| 127 | 130 | - name: Checkout base repository |
| 128 | 131 | uses: actions/checkout@v4 |
| 129 | 132 | with: |
| @@ -23,8 +23,8 @@ on: · 22 unmodified lines | ||
| 23 | 23 | type: string |
| 24 | 24 | |
| 25 | 25 | permissions: |
| 26 | − contents: write | |
| 27 | − id-token: write | |
| 26 | + contents: read | |
| 27 | + id-token: none | |
| 28 | 28 | |
| 29 | 29 | jobs: |
| 30 | 30 | check_changes: |
| @@ -420,6 +420,9 @@ jobs: · 389 unmodified lines | ||
| 420 | 420 | if: ${{ !failure() && !cancelled() && needs.preflight.result == 'success' && needs.build.result == 'success' }} |
| 421 | 421 | runs-on: ubuntu-24.04 # blacksmith-8vcpu-ubuntu-2404 |
| 422 | 422 | timeout-minutes: 10 |
| 423 | + permissions: | |
| 424 | + contents: read | |
| 425 | + id-token: write | |
| 423 | 426 | steps: |
| 424 | 427 | - name: Checkout |
| 425 | 428 | uses: actions/checkout@v6 |