feat(ci): least-privilege token permissions; fix 2 workflow bugs#27
Conversation
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (16)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…ix semantic-pr + first-interaction - Tightens every workflow's permission scope to per-job least-privilege (top-level `contents: read`; write-scopes pushed down to the job that needs them) so OpenSSF Scorecard's `Token-Permissions` check goes from 0/10 to clean. - Fixes `semantic-pr` "Resource not accessible by integration" by adding explicit per-job `contents: read` + `pull-requests: read`. - Fixes `first-interaction` "missing issue_message input" by using the correct underscore input names (`issue_message`, `pr_message`, `repo_token`) the action actually defines — the previous dashed variants were silently dropped.
amacsmith
force-pushed
the
ci/least-privilege-perms
branch
from
acf3895 to
de73aa0
Compare
There was a problem hiding this comment.
Pull request overview
This PR tightens GitHub Actions GITHUB_TOKEN permissions across workflows by adopting a workflow-level read-only baseline and moving any required write scopes down to the specific jobs that need them, aligning with OpenSSF Scorecard’s Token-Permissions guidance. It also addresses two workflow failures (semantic-pr permissions on pull_request_target, and first-interaction input naming).
Changes:
- Standardize most workflows to
permissions: contents: readat the workflow level, with job-level overrides for required write scopes (e.g.,contents: write,pull-requests: write,issues: write,actions: write,pages: write,id-token: write). - Fix
semantic-prfailing onpull_request_targetby explicitly setting job permissions (contents: read,pull-requests: read). - Fix
first-interactionfailing due to incorrect input names by switching to underscore-based input keys.
Reviewed changes
Copilot reviewed 16 out of 16 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/sync.yml | Moves contents/actions: write to the sync job while keeping a read-only workflow baseline. |
| .github/workflows/stale.yml | Moves issues/pull-requests: write to the stale job while keeping a read-only workflow baseline. |
| .github/workflows/semantic-pr.yml | Sets workflow baseline to contents: read and adds explicit job-level contents/pull-requests: read. |
| .github/workflows/scorecard.yml | Replaces read-all with contents: read at workflow level while retaining job-level perms needed for SARIF + publishing. |
| .github/workflows/render.yml | Sets workflow baseline to contents: read and scopes contents: write to the render job. |
| .github/workflows/release-please.yml | Sets workflow baseline to contents: read and scopes contents/pull-requests: write to the release job. |
| .github/workflows/publish-pysdk.yml | Sets workflow baseline to contents: read and scopes contents: write + id-token: write to the publish job. |
| .github/workflows/publish-mcp.yml | Moves id-token: write from workflow to the publish job. |
| .github/workflows/publish-cli.yml | Moves id-token: write from workflow to the publish job. |
| .github/workflows/pages.yml | Moves pages/id-token: write to the deploy job, adds explicit perms per job. |
| .github/workflows/outdated-watch.yml | Moves issues: write to the scan job while keeping a read-only workflow baseline. |
| .github/workflows/lychee.yml | Moves issues: write to the link-check job while keeping a read-only workflow baseline. |
| .github/workflows/labeler.yml | Moves pull-requests: write to the label job while keeping a read-only workflow baseline. |
| .github/workflows/first-interaction.yml | Moves write permissions to the greet job and fixes action input names. |
| .github/workflows/docs-on-release.yml | Sets workflow baseline to contents: read and scopes contents/actions: write to the update-docs job. |
| .github/workflows/auto-merge.yml | Sets workflow baseline to contents: read and scopes pull-requests: write + checks: read to the job. |
| .github/workflows/auto-merge-release-please.yml | Moves pull-requests: write to the auto-merge job while keeping a read-only workflow baseline. |
| .github/workflows/auto-merge-dependabot.yml | Moves pull-requests: write to the auto-merge job while keeping a read-only workflow baseline. |
| .github/workflows/add-from-issue.yml | Scopes contents/issues/pull-requests: write to the parse-and-pr job while keeping a read-only workflow baseline. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Summary
Tightens every workflow's permission scope to per-job least-privilege per OpenSSF Scorecard's Token-Permissions check (currently 0/10 because multiple workflows grant top-level write to
contents). Plus fixes the two known workflow bugs caught in #25 review.A. Token-Permissions audit
Every workflow now declares top-level
permissions: contents: read(or equivalent read-only minimum); any write-scope is pushed down to the specific job that actually needs it. Per-workflow changes:B. Workflow bug fixes
semantic-prwas failing withResource not accessible by integration. The job now declares per-jobcontents: read+pull-requests: readexplicitly sopull_request_targetevents still resolve correctly.first-interactionwas failing withmissing issue_message input. The action (actions/first-interaction@v3) uses underscore input names (issue_message,pr_message,repo_token) — the previous workflow used dashes which were silently dropped. Renamed all three to match the action'saction.yml.Verification
for f in .github/workflows/*.yml; do python3 -c "import yaml; yaml.safe_load(open('$f'))"; done-> ALL_YAML_OK (26 workflows parse).Test plan
Token-Permissionsat 10/10.semantic-prand it succeeds without the "Resource not accessible" error.first-interactionand posts the canned greeting.