Deferred from the v0.1 review (Refs #1): the cargo-dist-generated .github/workflows/release.yml grants contents: write (and GH_TOKEN) to every job, including the per-target build jobs that compile third-party code.
Expected: contents: read by default, contents: write only on the job that creates/uploads the GitHub Release; build jobs without GH_TOKEN.
Actual: workflow-wide contents: write, GH_TOKEN in build jobs.
Risk: medium — a compromised build dependency could publish release assets. No exploit path is known; the workflow is cargo-dist's stock template.
Why deferred: changing the template needs a real tag run to prove cargo-dist still uploads correctly (allow-dirty = ["ci"] is set so edits are permitted).
Next action: after the first successful v0.1.x release, scope permissions per job, run a pre-release tag to validate, then keep the change.
Deferred from the v0.1 review (Refs #1): the cargo-dist-generated
.github/workflows/release.ymlgrantscontents: write(andGH_TOKEN) to every job, including the per-target build jobs that compile third-party code.Expected:
contents: readby default,contents: writeonly on the job that creates/uploads the GitHub Release; build jobs withoutGH_TOKEN.Actual: workflow-wide
contents: write,GH_TOKENin build jobs.Risk: medium — a compromised build dependency could publish release assets. No exploit path is known; the workflow is cargo-dist's stock template.
Why deferred: changing the template needs a real tag run to prove cargo-dist still uploads correctly (
allow-dirty = ["ci"]is set so edits are permitted).Next action: after the first successful v0.1.x release, scope permissions per job, run a pre-release tag to validate, then keep the change.