From c8fdd4178e907f17779446c4ffbde76f06d69d99 Mon Sep 17 00:00:00 2001 From: jrfnl Date: Sat, 20 Sep 2025 05:08:24 +0200 Subject: [PATCH] GH Actions: set permissions for each workflow/job > Users frequently over-scope their workflow and job permissions, or set broad workflow-level permissions without realizing that all jobs inherit those permissions. > > Furthermore, users often don't realize that the _default_ `GITHUB_TOKEN` permissions can be very broad, meaning that workflows that don't configure any permissions at all can _still_ provide excessive credentials to their individual jobs. > > **Remediation** > In general, permissions should be declared as minimally as possible, and as close to their usage site as possible. > > In practice, this means that workflows should almost always set `permissions: {}` at the workflow level to disable all permissions by default, and then set specific job-level permissions as needed. This was already addressed for the other two workflows, just not for the `tests` one. As far as I can see, the jobs here do not need the `GITHUB_TOKEN` secret and even if they do, only for `content: read`, which for public repos does not need to be set explicitly, though it doesn't do any harm to have that set anyway. Refs: * https://docs.zizmor.sh/audits/#excessive-permissions --- .github/workflows/tests.yml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 65127019..30ba6233 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -6,8 +6,7 @@ on: # Allow manually triggering the workflow. workflow_dispatch: -permissions: - contents: read # to fetch code (actions/checkout) +permissions: {} jobs: @@ -15,6 +14,9 @@ jobs: runs-on: ubuntu-22.04 name: Coding standards + permissions: + contents: read # to fetch code (actions/checkout) + steps: - name: Check out code uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 @@ -57,6 +59,9 @@ jobs: name: "Lint: PHP ${{ matrix.php }}" continue-on-error: ${{ matrix.experimental }} + permissions: + contents: read # to fetch code (actions/checkout) + steps: - name: Checkout code uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 @@ -129,6 +134,9 @@ jobs: continue-on-error: ${{ matrix.experimental }} + permissions: + contents: read # to fetch code (actions/checkout) + steps: - name: Check out code uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0