authorgravatar for julius0216@outlook.comJulius Marminge <julius0216@outlook.com> 2026-05-13 14:19:18+02:00
committergravatar for julius0216@outlook.comJulius Marminge <julius0216@outlook.com> 2026-05-13 14:19:18+02:00
log556c42452c5ac94ae8d8698d64fcd372c1680955
tree32b139f94de1afc7fc71d900ad77417661727139
parent7e20b23e7ea5dc1daf4cbfa65d61301d99168bae

Harden GitHub workflow permissions

- Restrict release workflow defaults to read-only access - Grant `id-token` only to the publish job - Document safe handling for `pull_request_target` in PR size checks

2 files changed, 8 insertions(+), 2 deletions(-)

.github/workflows/pr-size.yml+3
...@@ -124,6 +124,9 @@ jobs:...@@ -124,6 +124,9 @@ jobs:
124 group: pr-size-${{ github.event.pull_request.number }}124 group: pr-size-${{ github.event.pull_request.number }}
125 cancel-in-progress: true125 cancel-in-progress: true
126 steps:126 steps:
127 # This pull_request_target job may fetch untrusted PR commits only as passive
128 # git data. Do not add dependency installs, build/test scripts, or cache
129 # actions here; use pull_request plus workflow_run for that pattern instead.
127 - name: Checkout base repository130 - name: Checkout base repository
128 uses: actions/checkout@v4131 uses: actions/checkout@v4
129 with:132 with:
.github/workflows/release.yml+5-2
...@@ -23,8 +23,8 @@ on:...@@ -23,8 +23,8 @@ on:
23 type: string23 type: string
2424
25permissions:25permissions:
26 contents: write26 contents: read
27 id-token: write27 id-token: none
2828
29jobs:29jobs:
30 check_changes:30 check_changes:
...@@ -420,6 +420,9 @@ jobs:...@@ -420,6 +420,9 @@ jobs:
420 if: ${{ !failure() && !cancelled() && needs.preflight.result == 'success' && needs.build.result == 'success' }}420 if: ${{ !failure() && !cancelled() && needs.preflight.result == 'success' && needs.build.result == 'success' }}
421 runs-on: ubuntu-24.04 # blacksmith-8vcpu-ubuntu-2404421 runs-on: ubuntu-24.04 # blacksmith-8vcpu-ubuntu-2404
422 timeout-minutes: 10422 timeout-minutes: 10
423 permissions:
424 contents: read
425 id-token: write
423 steps:426 steps:
424 - name: Checkout427 - name: Checkout
425 uses: actions/checkout@v6428 uses: actions/checkout@v6