Repository navigation
chore(ci): pin least-privilege token permissions in the CI workflow - #1440
Conversation
`ci.yml` runs on `pull_request` and executes code from the PR branch (tests, builds, scripts) but declared no workflow-level `permissions`, so its token scope depended on the repository's default-token setting. - add top-level `permissions: contents: read` - `changes` job keeps `pull-requests: read` for `dorny/paths-filter` - set `persist-credentials: false` on the `actions/checkout` steps of the jobs that run PR code (no later step in those jobs needs git credentials) No action versions, steps, or ordering changed. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to The workflow limits CI token access and avoids persisting checkout credentials in jobs that run pull-request code. No actionable merge-blocking issue was found. Pre-merge checks |
 |
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title clearly summarizes the main change: pinning least-privilege token permissions in the CI workflow. |
| Description check | |
The description includes the issue, change type, detailed implementation summary, verification steps, screenshots status, and completed checklist. It directly matches the pull request objectives. |
| Linked Issues check | |
Issue #1439 requires workflow-level contents: read, pull-requests: read only for the changes job, and persist-credentials: false for checkout steps in jobs that run PR code. The reviewed diff … |
| Out of Scope Changes check | |
The whole-PR diff contains changes only in .github/workflows/ci.yml. Each changed line adds the permissions or checkout credential setting described in issue #1439. No unrelated application, test, a… |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
✨ Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
A rabbit checks the workflow lines
Read-only tokens keep their bounds
Checkout leaves no saved key behind
Seven jobs follow that design
The marker guard keeps full history
Then hops away, content and free
Comment @coderabbitai help to get the list of available commands.
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Files Reviewed (1 files)
Reviewed by gpt-6-sol · Input: 14 · Output: 2.1K · Cached: 207.2K Review guidance: REVIEW.md from base branch |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
1 participant
Issue for this PR
Closes #1439
Type of change
What does this PR do?
Standard least-privilege hardening of the CI workflow. The CI workflow runs on pull_request and executes code from the PR branch (tests, builds, scripts), but it declared no workflow-level permissions, so the scope of its token depended on a repository setting (the default workflow token permission). A workflow that runs PR code should not rely on a repo setting to get a read-only token, so this pins it in the file.
Changes, all in .github/workflows/ci.yml:
Per-job result (no job needs a write scope; no step calls the GitHub API with write, pushes, or uses OIDC):
Deliberately not changed: the other workflows. aireceipts and dispatch-code-review already declare permissions; the remaining ones use pull_request_target, schedule, push or release triggers. No action versions, steps, or ordering were touched.
How did you verify your code works?
Screenshots / recordings
N/A
Checklist
🤖 Generated with Claude Code
Note
Low Risk
Workflow-only token scoping and checkout credential hygiene; no application or runtime behavior changes.
Overview
Hardens the CI workflow so PR jobs no longer depend on the repo’s default
GITHUB_TOKENscope when running untrusted branch code.Adds a workflow-level
permissions: contents: read, grantspull-requests: readon the Detect Changes job (forpaths-filter), and setspersist-credentials: falseonactions/checkoutfor every job that executes PR code—so tests/scripts cannot read the token from git config. No job steps, action versions, or test commands were changed.Reviewed by Cursor Bugbot for commit 1c970b1. Bugbot is set up for automated code reviews on this repo. Configure here.
Summary by cubic
Hardens the
ci.ymlworkflow with least-privilege token permissions so jobs that run pull-request code get a read-only token regardless of the repository's default setting.permissions: contents: readblock.pull-requests: readsodorny/paths-filtercan list the PR's files through the API.persist-credentials: falseon the checkout step of every job running PR code so the checked-out code cannot read the token from git config.Written for commit 1c970b1. Summary will update on new commits.
Summary by CodeRabbit