fix: restrict GITHUB_TOKEN permissions in workflows - #388
Merged
Merged
Conversation
Add top-level `permissions: {}` to 13 workflow files that were missing
it, ensuring GITHUB_TOKEN defaults to no permissions. Individual jobs
already declare their required permissions at the job level.
This resolves OSSF Scorecard Token-Permissions findings.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
📝 WalkthroughWalkthroughThirteen GitHub Actions workflows now include a top-level ChangesWorkflow Permission Hardening
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/pr-validation-docs.yml:
- Around line 16-17: The workflow sets global permissions to empty which
prevents the validate-site-links job from using GITHUB_TOKEN to run
actions/checkout; update the permissions stanza so that the validate-site-links
job (named validate-site-links) has contents: read available — either add
contents: read to the workflow-level permissions or explicitly add permissions:
{ contents: read, packages: read } to the validate-site-links job so
actions/checkout can use GITHUB_TOKEN to check out the repository.
In @.github/workflows/pr-validation-fork.yml:
- Around line 7-8: The job-level permissions for integration-tests-fork are
missing the read permission required for checkout and the pull request lookup:
update the integration-tests-fork job (which currently has permissions: {
checks: write, packages: read }) to include contents: read so that the
actions/checkout step and the call to github.rest.pulls.get are explicitly
authorized; keep the workflow default permissions: {} but add contents: read
under the integration-tests-fork job permissions.
In @.github/workflows/scan-controller-image.yaml:
- Around line 18-19: The workflow currently sets empty workflow-level
permissions and the scan-image job only grants packages: read, so GITHUB_TOKEN
lacks contents: read required by actions/checkout; update the scan-image job's
permissions block (the permissions key under the scan-image job) to include
contents: read in addition to packages: read (e.g., permissions: { contents:
read, packages: read }) so actions/checkout can fetch the repository.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: ee152f76-6430-4558-a453-30c606f84e41
📒 Files selected for processing (13)
.github/workflows/add-needs-triage-label.yml.github/workflows/api-docs-repo.yaml.github/workflows/build-devcontainer-image.yml.github/workflows/codeql.yml.github/workflows/deploy-site.yml.github/workflows/helm-chart-repo.yaml.github/workflows/live-validation.yml.github/workflows/ok-to-test.yml.github/workflows/pr-validation-docs.yml.github/workflows/pr-validation-fork.yml.github/workflows/pre-release-tests.yaml.github/workflows/scan-controller-image.yaml.github/workflows/visualize-repo.yml
…kout
Setting permissions: {} at the workflow level removes all implicit
GITHUB_TOKEN permissions including contents: read. Jobs that use
actions/checkout need this permission explicitly declared at the job
level, otherwise checkout will fail with a 403 error.
Affected workflows: codeql, deploy-site, pr-validation-docs,
pr-validation-fork, scan-controller-image.
Self-review finding addressed before external review.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Collaborator
Author
AI Review Pipeline Summary
Self-Review Fixes Applied
DetailsThe self-review identified that 5 workflows would break after adding No security vulnerabilities, CodeRabbit findings, or Qodo findings were identified. All CodeRabbit threads resolved: Yes. PR description updated: Already current (no changes made). 🤖 Generated by |
Collaborator
Author
|
/retest |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: marek-veber, RadekCap The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
permissions: {}to 13 workflow files that were missing itGITHUB_TOKENdefaults to no permissions at the workflow levelcontents: readto 5 jobs that useactions/checkoutbut were relying on the implicit defaultToken-Permissionsfindings (alerts Update github.com/Azure/ARO-HCP/test/sdk/resourcemanager/redhatopenshifthcp/armredhatopenshifthcp digest to 541a3a7 #10-Update k8s.io/utils digest to 28399d8 #13, Update module github.com/imdario/mergo to v0.3.16 #18-Update module go.uber.org/zap to v1.27.1 #27)Affected workflows
add-needs-triage-label.ymlissues: writeapi-docs-repo.yamlcontents: read,packages: readbuild-devcontainer-image.ymlpackages: write,contents: readcodeql.ymlsecurity-events: write,packages: read,contents: read✨deploy-site.ymlcontents: read,packages: read✨helm-chart-repo.yamlcontents: read,packages: readlive-validation.ymlcontents: readok-to-test.ymlpull-requests: writepr-validation-docs.ymlcontents: read,packages: read✨pr-validation-fork.ymlchecks: write,contents: read,packages: read✨pre-release-tests.yamlcontents: readscan-controller-image.yamlcontents: read,packages: read✨visualize-repo.ymlcontents: read✨ =
contents: readwas added at the job level in this PR (previously relied on the implicit default)Test plan
🤖 Generated with Claude Code