From 822a14322d863b7672016567abd9b41ef8997749 Mon Sep 17 00:00:00 2001 From: Alexander Tarasov Date: Tue, 4 Aug 2026 16:13:10 +0200 Subject: [PATCH 1/2] ci: Remove secrets: inherit from changelog-preview workflow The reusable getsentry/craft changelog-preview.yml workflow only uses the auto-provisioned GITHUB_TOKEN and doesn't declare any workflow_call secrets. Inheriting all repository secrets into it violates least privilege and isn't needed to make the workflow function. Refs VULN-2346 Co-Authored-By: Claude Sonnet 5 --- .github/workflows/changelog-preview.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/changelog-preview.yml b/.github/workflows/changelog-preview.yml index 1d5e7cd11..9bb412e86 100644 --- a/.github/workflows/changelog-preview.yml +++ b/.github/workflows/changelog-preview.yml @@ -15,4 +15,3 @@ permissions: jobs: changelog-preview: uses: getsentry/craft/.github/workflows/changelog-preview.yml@cdb657d4bbc70cd497876ad158984b4d345a48ae # v2 - secrets: inherit From 10d5bc14f7c15d80df5b8689440119860e97c31d Mon Sep 17 00:00:00 2001 From: Alexander Tarasov Date: Tue, 4 Aug 2026 22:27:06 +0200 Subject: [PATCH 2/2] ci: Remove disabled changelog-preview workflow changelog-preview.yml is disabled_manually on GitHub and unused. Rather than fixing its secrets: inherit usage, remove the workflow entirely, consistent with how other getsentry repos are dropping this disabled workflow. Refs VULN-2346 Co-Authored-By: Claude Sonnet 5 --- .github/workflows/changelog-preview.yml | 17 ----------------- 1 file changed, 17 deletions(-) delete mode 100644 .github/workflows/changelog-preview.yml diff --git a/.github/workflows/changelog-preview.yml b/.github/workflows/changelog-preview.yml deleted file mode 100644 index 9bb412e86..000000000 --- a/.github/workflows/changelog-preview.yml +++ /dev/null @@ -1,17 +0,0 @@ -name: Changelog Preview -on: - pull_request: - types: - - opened - - synchronize - - reopened - - edited - - labeled - - unlabeled -permissions: - contents: write - pull-requests: write - -jobs: - changelog-preview: - uses: getsentry/craft/.github/workflows/changelog-preview.yml@cdb657d4bbc70cd497876ad158984b4d345a48ae # v2