authorgravatar for julius0216@outlook.comJulius Marminge <julius0216@outlook.com> 2026-05-13 14:19:18+02:00
committergravatar for julius0216@outlook.comJulius Marminge <julius0216@outlook.com> 2026-05-13 14:19:18+02:00
log556c42452c5ac94ae8d8698d64fcd372c1680955
tree32b139f94de1afc7fc71d900ad77417661727139
parent7e20b23e7ea5dc1daf4cbfa65d61301d99168bae

Harden GitHub workflow permissions

- Restrict release workflow defaults to read-only access - Grant `id-token` only to the publish job - Document safe handling for `pull_request_target` in PR size checks

2 files changed, 8 insertions(+), 2 deletions(-)

.github/workflows/pr-size.yml+3
......@@ -124,6 +124,9 @@ jobs:
124124 group: pr-size-${{ github.event.pull_request.number }}
125125 cancel-in-progress: true
126126 steps:
127 # This pull_request_target job may fetch untrusted PR commits only as passive
128 # git data. Do not add dependency installs, build/test scripts, or cache
129 # actions here; use pull_request plus workflow_run for that pattern instead.
127130 - name: Checkout base repository
128131 uses: actions/checkout@v4
129132 with:
.github/workflows/release.yml+5-2
......@@ -23,8 +23,8 @@ on:
2323 type: string
2424
2525permissions:
26 contents: write
27 id-token: write
26 contents: read
27 id-token: none
2828
2929jobs:
3030 check_changes:
......@@ -420,6 +420,9 @@ jobs:
420420 if: ${{ !failure() && !cancelled() && needs.preflight.result == 'success' && needs.build.result == 'success' }}
421421 runs-on: ubuntu-24.04 # blacksmith-8vcpu-ubuntu-2404
422422 timeout-minutes: 10
423 permissions:
424 contents: read
425 id-token: write
423426 steps:
424427 - name: Checkout
425428 uses: actions/checkout@v6