ci: declare least-privilege GITHUB_TOKEN permissions - #51
Merged
Conversation
node-red-standards 0.6.1. A workflow with no permissions block inherits the repository default, which on many repos is read *and write* to everything -- so a compromised action or a malicious dependency in a CI run gets a token that can push commits. Both workflows now start from contents: read; github-release raises itself to contents: write because it creates the release. npm authentication is a separate secret and is unaffected. This repo and node-red-contrib-ntrip were the two left behind when the permissions pass went through the others, and the reason is worth naming: they are exactly the two without code scanning enabled. The same gap was here, nothing reported it. In the four repos that do have it this closed 13 actions/missing-workflow-permissions alerts. Verified: lint, format:check and 20 tests pass; both files parse as YAML. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings both workflows up to node-red-standards 0.6.1. This repo and
node-red-contrib-shellyare the two that were left behind when the permissions pass went through the others — and the reason is worth naming: they are exactly the two repos without code scanning enabled. The same gap existed here, nothing reported it.Both files differ from the current template by nothing but the permissions block, so this is an exact template match rather than a merge.
Why it matters
A workflow with no
permissions:block inherits the repository default, which on many repos is read and write to everything — so a compromised action or a malicious dependency in a CI run gets a token that can push commits. Both files now start fromcontents: read; innpm-publish.ymlthe one job that needs more (github-release, which creates the release) raises itself tocontents: write. npm authentication is a separate secret and is unaffected.In the four repos that do have code scanning this closed 13
actions/missing-workflow-permissionsalerts.Verified locally:
npm run lint,npm run format:checkand all 20 tests pass; both files parse as YAML.