From 556c42452c5ac94ae8d8698d64fcd372c1680955 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Wed, 13 May 2026 14:19:18 +0200
Subject: [PATCH] Harden GitHub workflow permissions

- Restrict release workflow defaults to read-only access
- Grant `id-token` only to the publish job
- Document safe handling for `pull_request_target` in PR size checks
---
 .github/workflows/pr-size.yml | 3 +++
 .github/workflows/release.yml | 7 +++++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/pr-size.yml b/.github/workflows/pr-size.yml
index 15c04d663d36d154cac78a0d9ec84104b173345c..af557dff62df8ffbc330805672a349da53e3d56f 100644
--- a/.github/workflows/pr-size.yml
+++ b/.github/workflows/pr-size.yml
@@ -124,6 +124,9 @@ jobs:
       group: pr-size-${{ github.event.pull_request.number }}
       cancel-in-progress: true
     steps:
+      # This pull_request_target job may fetch untrusted PR commits only as passive
+      # git data. Do not add dependency installs, build/test scripts, or cache
+      # actions here; use pull_request plus workflow_run for that pattern instead.
       - name: Checkout base repository
         uses: actions/checkout@v4
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 367ce867dc3bab09eed14051126358496f289976..d90479087cfabb9f6fa1ab7b0a35b755c937a187 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,8 +23,8 @@ on:
         type: string
 
 permissions:
-  contents: write
-  id-token: write
+  contents: read
+  id-token: none
 
 jobs:
   check_changes:
@@ -420,6 +420,9 @@ jobs:
     if: ${{ !failure() && !cancelled() && needs.preflight.result == 'success' && needs.build.result == 'success' }}
     runs-on: ubuntu-24.04 # blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 10
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: Checkout
         uses: actions/checkout@v6
-- 
2.54.0