Apply least-privilege permissions to GitHub Actions workflow - #7
Conversation
Co-authored-by: Sakura-Ex <49809606+Sakura-Ex@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
This PR tightens the GitHub Actions workflow token permissions to follow least-privilege by defaulting to read-only repository contents access and elevating permissions only for the release job.
Changes:
- Set workflow-level
permissionstocontents: read - Add job-level override
permissions: contents: writefor thereleasejob
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| permissions: | ||
| contents: write | ||
| contents: read | ||
|
|
There was a problem hiding this comment.
Setting workflow-level permissions to only contents: read implicitly sets all other GITHUB_TOKEN permissions to none. This workflow uses actions/cache@v4 and actions/upload-artifact@v4 / actions/download-artifact@v4, which require actions: write (cache save/upload) and at least actions: read (download). As-is, the test/build/release jobs may start failing with permission errors. Add the minimal required actions: permission at workflow level and/or per job (e.g., grant actions: write to jobs that save cache/upload artifacts, and actions: read to jobs that only download).
| if: startsWith(github.ref, 'refs/tags/v') | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: write |
There was a problem hiding this comment.
The release job overrides contents: write but still inherits actions: none from the workflow-level permissions. Since this job uses actions/download-artifact@v4, it needs actions: read (or actions: write) to fetch artifacts; otherwise the download step can fail. Add actions: read to the release job's permissions block (and keep contents: write).
| contents: write | |
| contents: write | |
| actions: read |
Addresses security feedback to restrict workflow permissions following the principle of least privilege.
Changes
contents: read(default for all jobs)contents: writeat job-level forreleasejob onlyThis ensures
testandbuildjobs run with read-only access, while onlyreleaseretains write permissions needed for creating GitHub releases.✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.