chore: apply least privilege permissions to github actions - #40687
Conversation
|
Looks like this PR is ready to merge! 🎉 |
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (12)
🚧 Files skipped from review as they are similar to previous changes (11)
📜 Recent review details⏰ Context from checks skipped due to timeout. (3)
|
| Layer / File(s) | Summary |
|---|---|
Workflow permission defaults .github/workflows/auto-close-duplicates.yml, .github/workflows/dedupe-issues.yml, .github/workflows/ci-deploy-gh-pages.yml, .github/workflows/ci-test-e2e.yml, .github/workflows/ci-test-storybook.yml, .github/workflows/ci-test-unit.yml, .github/workflows/ci.yml, .github/workflows/new-release.yml, .github/workflows/pr-update-description.yml, .github/workflows/publish-release.yml, .github/workflows/release-candidate.yml, .github/workflows/update-version-durability.yml |
Workflow-level permission blocks are added to restrict or define default GITHUB_TOKEN access in several workflows. |
Job read-scoped permissions .github/workflows/ci-code-check.yml, .github/workflows/ci-test-e2e.yml, .github/workflows/ci.yml, .github/workflows/new-release.yml, .github/workflows/pr-update-description.yml, .github/workflows/publish-release.yml, .github/workflows/release-candidate.yml, .github/workflows/update-version-durability.yml |
Job-level permissions are added to grant read-only access for check, release, update, and test jobs. |
Job write-scoped permissions .github/workflows/ci-deploy-gh-pages.yml, .github/workflows/codeql-analysis.yml |
Job-level permissions are added to grant write access for GitHub Pages deployment and CodeQL security event reporting. |
Estimated code review effort: 2 (Simple) | ~12 minutes
Suggested labels: type: chore
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
| Check name | Status | Explanation |
|---|---|---|
| Description Check | ✅ Passed | Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | ✅ Passed | The title accurately summarizes the main change: tightening GitHub Actions permissions to least privilege. |
| Docstring Coverage | ✅ Passed | No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. |
| Linked Issues check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
Warning
Review ran into problems
🔥 Problems
Errors were encountered while retrieving linked issues.
Errors (1)
- SB-975: Request failed with status code 401
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## develop #40687 +/- ##
===========================================
+ Coverage 69.14% 69.88% +0.74%
===========================================
Files 3433 3379 -54
Lines 132323 130505 -1818
Branches 23091 22890 -201
===========================================
- Hits 91489 91198 -291
+ Misses 37472 36004 -1468
+ Partials 3362 3303 -59
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
yasnagat
changed the title
yasnagat
changed the title
This reverts commit a9f7948.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 25-26: The workflow default grants repository read to all jobs;
change the workflow-level permissions from "contents: read" to an empty mapping
(permissions: {}) and then add "contents: read" to only the jobs that need it
(e.g., the release-versions job and any jobs that run checkout/git operations).
Update the job definitions (for example, the release-versions job) to include a
job-level permissions block granting contents: read so those jobs retain
required access while other jobs remain least-privilege.
In @.github/workflows/new-release.yml:
- Around line 23-24: The workflow currently passes the PAT to actions/checkout
(via with: token: ${{ secrets.CI_PAT }}) and also sets env: GITHUB_TOKEN at job
level, which persists the PAT for subsequent steps; update the actions/checkout
step(s) that use ${{ secrets.CI_PAT }} to include persist-credentials: false,
remove the workflow/job-level env: GITHUB_TOKEN: ${{ secrets.CI_PAT }}, and
instead pass the PAT only to the specific step(s) that need it (e.g., the
./packages/release-action step) by setting env or with on that step alone so
checkout doesn't leave a PAT-backed credential available to later steps.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 3af1d1cc-4784-4269-a2f3-8dbd7107970d
📒 Files selected for processing (14)
.github/workflows/auto-close-duplicates.yml.github/workflows/ci-code-check.yml.github/workflows/ci-deploy-gh-pages.yml.github/workflows/ci-test-e2e.yml.github/workflows/ci-test-storybook.yml.github/workflows/ci-test-unit.yml.github/workflows/ci.yml.github/workflows/codeql-analysis.yml.github/workflows/dedupe-issues.yml.github/workflows/new-release.yml.github/workflows/pr-update-description.yml.github/workflows/publish-release.yml.github/workflows/release-candidate.yml.github/workflows/update-version-durability.yml
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: cubic · AI code reviewer
- GitHub Check: Hacktron Security Check
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2026-04-27T18:32:21.871Z
Learnt from: d-gubert
Repo: RocketChat/Rocket.Chat PR: 40321
File: .github/workflows/ci.yml:137-145
Timestamp: 2026-04-27T18:32:21.871Z
Learning: In .github/workflows/ci.yml, the `diff` step under `release-versions` intentionally uses a bash `if` with `gh pr diff ... | grep -q ...; then ... fi`. For non-`pull_request` workflow triggers where `GH_PR_NUM` can be empty, the `gh` command may fail, but the surrounding bash `if` is relied on to treat that failure as the condition being false and skip the `then` block, allowing the step/job to exit cleanly. Do not add extra guards for non-PR event types unless this failure/skip behavior is intentionally changed.
Applied to files:
.github/workflows/ci.yml
🔇 Additional comments (10)
.github/workflows/auto-close-duplicates.yml (1)
8-16: LGTM!.github/workflows/ci-code-check.yml (1)
16-22: LGTM!.github/workflows/ci-deploy-gh-pages.yml (1)
11-17: LGTM!.github/workflows/ci-test-e2e.yml (1)
71-77: LGTM!.github/workflows/ci-test-storybook.yml (1)
22-28: LGTM!.github/workflows/ci-test-unit.yml (1)
26-32: LGTM!.github/workflows/ci.yml (1)
32-34: LGTM!.github/workflows/codeql-analysis.yml (1)
15-18: LGTM!.github/workflows/dedupe-issues.yml (1)
13-14: LGTM!Also applies to: 19-21
.github/workflows/update-version-durability.yml (1)
16-17: Permission change is safe for publishing (local action doesn’t rely on checkout’s push remote).
.github/actions/update-version-durability/index.jspublishes via Document360 (D360_TOKEN) and only reads GitHub releases via Octokit using the providedGH_TOKEN; there’s nogit push/remote configuration in the action, socontents: readonGITHUB_TOKENdoesn’t affect the publish path.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
2 issues found across 14 files
Tip: cubic used a learning from your PR history. Let your coding agent read cubic learnings directly with the cubic MCP.
Re-trigger cubic
8e87cf2 to
28c4684
Compare
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
tassoevan
added
the
stat: QA assured
dionisio-bot
Bot
added
the
stat: ready to merge
3 participants
Proposed changes (including videos or screenshots)
This PR applies the principle of least privilege to
GITHUB_TOKENpermissions across all GitHub Actions workflows by settingpermissions: {}globally and explicitly re-granting only the minimum permissions required per job, as part of a supply chain security hardening effort.Workflows relied on GitHub’s default token scopes, which may grant more access than most jobs actually need. Scoping permissions at the job level reduces the attack surface in the event that a GitHub Action, third-party dependency, or CI component is compromised, helping mitigate the impact of potential supply chain attacks and limiting unnecessary repository access.
This change only affects the permissions granted to the workflow
GITHUB_TOKEN. Operations authenticated using explicitly configured Personal Access Tokens (PATs) continue to have the scopes assigned to those tokens and are not affected by workflowpermissionssettings.Issue(s)
SB-975
Steps to test or reproduce
Further comments
Summary by CodeRabbit
contents: read), with targeted exceptions for publishing (e.g., GitHub Pages deploy withcontents: write) and security reporting (e.g., CodeQL withsecurity-events: write).