Extend explicit workflow permissions to 19 check/lint/quickstart workflows#17172
Open
arpitjain099 wants to merge 1 commit into
Open
Extend explicit workflow permissions to 19 check/lint/quickstart workflows#17172arpitjain099 wants to merge 1 commit into
arpitjain099 wants to merge 1 commit into
Conversation
…flows PR microsoft#7282 made a first pass at making GitHub Actions permissions explicit in this repo. Since then several check/lint workflows and the 2.0 quickstart have been added without permissions blocks (the old hardened files were deleted or renamed, e.g. check-livepatches.yml and quickstart_1.0.yml). All 19 workflows in this PR are pure CI: they fire on push/pull_request (or schedule/workflow_dispatch for the quickstart), check out the repo, and run spec/package/lint validators. None push commits, create releases, or call write APIs, so 'contents: read' is the correct minimum. The two workflows that intentionally use 'permissions: {}' with pull_request_target (check-rendered-specs-stub.yml, spec-review-stub.yml) are not touched — those have a deliberate stub+reusable architecture and already declare scope correctly. Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
arpitjain099
force-pushed
the
ci/declare-permissions
branch
from
86e8397 to
0600f12
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Following up on #7282, which made a first pass at declaring explicit
permissions:blocks in this repo. Since then several new check/lint workflows have been added and the 2.0 quickstart was renamed without picking up the same hardening, so most of the validators in.github/workflows/are once again running with the repository default token scope.This patch adds a top-level
to 19 workflows:
All 19 fire on
push/pull_request(orschedule/workflow_dispatchforquickstart_2.0.yml), check out the repo, and run spec / package / lint validators. None push commits, create releases, or call write APIs.The two workflows that already declare
permissions: {}withpull_request_target(check-rendered-specs-stub.yml,spec-review-stub.yml) are intentionally left alone — they have a stub-plus-reusable architecture with explicit scope notes and don't need a different default.YAML validated locally with PyYAML before commit; diff is +57 lines, no other changes.