Skip to content

Apply least-privilege permissions to GitHub Actions workflow #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Sakura-Ex merged 2 commits into from
Feb 7, 2026
Merged

Apply least-privilege permissions to GitHub Actions workflow #7

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
dca766b
Initial plan
Copilot Feb 7, 2026
b460f74
Apply least-privilege principle to workflow permissions
Copilot Feb 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ concurrency:
cancel-in-progress: true

permissions:
contents: write
contents: read

Comment on lines 25 to 27

Copilot AI Feb 7, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Setting workflow-level permissions to only contents: read implicitly sets all other GITHUB_TOKEN permissions to none. This workflow uses actions/cache@v4 and actions/upload-artifact@v4 / actions/download-artifact@v4, which require actions: write (cache save/upload) and at least actions: read (download). As-is, the test/build/release jobs may start failing with permission errors. Add the minimal required actions: permission at workflow level and/or per job (e.g., grant actions: write to jobs that save cache/upload artifacts, and actions: read to jobs that only download).

Copilot uses AI. Check for mistakes.
jobs:
# 1. 测试任务
Expand Down Expand Up @@ -100,6 +100,8 @@ jobs:
needs: build
if: startsWith(github.ref, 'refs/tags/v')
runs-on: ubuntu-latest
permissions:
contents: write

Copilot AI Feb 7, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The release job overrides contents: write but still inherits actions: none from the workflow-level permissions. Since this job uses actions/download-artifact@v4, it needs actions: read (or actions: write) to fetch artifacts; otherwise the download step can fail. Add actions: read to the release job's permissions block (and keep contents: write).

Suggested change
contents: write
contents: write
actions: read

Copilot uses AI. Check for mistakes.
steps:
- name: Download Artifact
uses: actions/download-artifact@v4
Expand Down