Skip to content

CI: add least-privilege permissions to GitHub Actions workflows#122

Open
peter-matkovski wants to merge 11 commits into
mainfrom
ci/workflow-least-privilege-permissions
Open

CI: add least-privilege permissions to GitHub Actions workflows#122
peter-matkovski wants to merge 11 commits into
mainfrom
ci/workflow-least-privilege-permissions

Conversation

@peter-matkovski

@peter-matkovski peter-matkovski commented Jul 8, 2026 •
edited
Loading

Copy link
Copy Markdown

Summary

  • Add explicit least-privilege permissions blocks to workflow files flagged by CodeQL.
  • Scopes derived from workflow operations (build, artifacts, Danger, release git push).
  • Resolves 6 open actions/missing-workflow-permissions alerts.

Linear

Test plan

  • CI green
  • Code scanning alerts close after merge

@peter-matkovski
CI: add least-privilege permissions to GitHub Actions workflows
5efdc71 
Add explicit workflow-level permissions blocks to resolve CodeQL
actions/missing-workflow-permissions alerts. Scopes are derived from
workflow operations (git push, artifact upload, Danger, release lanes).

Refs: APPSEC-164
@peter-matkovski
CI: add least-privilege permissions to GitHub Actions workflows
7e8f6de 
Add explicit workflow-level permissions blocks to resolve CodeQL
actions/missing-workflow-permissions alerts. Scopes are derived from
workflow operations (git push, artifact upload, Danger, release lanes).

Refs: APPSEC-164
@peter-matkovski
CI: add least-privilege permissions to GitHub Actions workflows
4036591 
Add explicit workflow-level permissions blocks to resolve CodeQL
actions/missing-workflow-permissions alerts. Scopes are derived from
workflow operations (git push, artifact upload, Danger, release lanes).

Refs: APPSEC-164
@peter-matkovski
CI: add least-privilege permissions to GitHub Actions workflows
dcdbae4 
Add explicit workflow-level permissions blocks to resolve CodeQL
actions/missing-workflow-permissions alerts. Scopes are derived from
workflow operations (git push, artifact upload, Danger, release lanes).

Refs: APPSEC-164
@peter-matkovski
CI: add least-privilege permissions to GitHub Actions workflows
faebed6 
Add explicit workflow-level permissions blocks to resolve CodeQL
actions/missing-workflow-permissions alerts. Scopes are derived from
workflow operations (git push, artifact upload, Danger, release lanes).

Refs: APPSEC-164
@peter-matkovski
CI: add least-privilege permissions to GitHub Actions workflows
f8af012 
Add explicit workflow-level permissions blocks to resolve CodeQL
actions/missing-workflow-permissions alerts. Scopes are derived from
workflow operations (git push, artifact upload, Danger, release lanes).

Refs: APPSEC-164
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 8, 2026 11:27 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 8, 2026 11:27 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 8, 2026 11:27 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 8, 2026 11:27 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 8, 2026 11:27 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 8, 2026 11:27 — with GitHub Actions Inactive
@peter-matkovski peter-matkovski self-assigned this Jul 8, 2026
@peter-matkovski
peter-matkovski requested a review from a team July 9, 2026 09:37
@peter-matkovski
peter-matkovski enabled auto-merge (squash) July 9, 2026 11:41
mogita
mogita reviewed Jul 9, 2026
View reviewed changes
Comment thread .github/workflows/release.yml Outdated
Comment thread .github/workflows/reviewdog.yml Outdated
Comment thread .github/workflows/scheduled_test.yml Outdated
@peter-matkovski @mogita
Update .github/workflows/scheduled_test.yml
397f3bc 
Co-authored-by: 🌵 Yun Wang <yun.wang@getstream.io>
@peter-matkovski @mogita
Update .github/workflows/release.yml
8d3a02c 
Co-authored-by: 🌵 Yun Wang <yun.wang@getstream.io>
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 13, 2026 09:47 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 13, 2026 09:47 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 13, 2026 09:47 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 13, 2026 09:47 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 13, 2026 09:47 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski requested a review from mogita July 13, 2026 10:59
@peter-matkovski @mogita
Update .github/workflows/reviewdog.yml
38ea1fe 
Co-authored-by: 🌵 Yun Wang <yun.wang@getstream.io>
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 14, 2026 08:24 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 14, 2026 08:24 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 14, 2026 08:24 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 14, 2026 08:24 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 14, 2026 08:24 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 14, 2026 08:24 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 14, 2026 11:54 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 14, 2026 11:54 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 14, 2026 11:54 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 14, 2026 11:54 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 14, 2026 11:54 — with GitHub Actions Inactive
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mogita mogita mogita approved these changes
@tbarbugli tbarbugli Awaiting requested review from tbarbugli tbarbugli is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

@peter-matkovski peter-matkovski

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@peter-matkovski @mogita