Skip to content

security: add workflow permissions for least privilege#92

Open
rayketcham wants to merge 2 commits intomainfrom
security/add-workflow-permissions
Open

security: add workflow permissions for least privilege#92
rayketcham wants to merge 2 commits intomainfrom
security/add-workflow-permissions

Conversation

@rayketcham
Copy link
Copy Markdown
Contributor

@rayketcham rayketcham commented Apr 19, 2026

Summary

  • Add explicit top-level `permissions:` blocks to 5 workflow files that were missing them
  • Follows principle of least privilege — each workflow gets only the permissions it actually uses
  • Resolves GitHub Code Security "Workflow does not contain permissions" alerts
  • Two workflows (`crypto-validation.yml`, `release-check.yml`) that use `gh issue create/close` get `issues: write` in addition to `contents: read`

Changes

  • `ci.yml`: `contents: read` (build/test/audit only)
  • `daily-check.yml`: `contents: read` (build/test/audit only)
  • `interop.yml`: `contents: read` (build and artifact upload/download only)
  • `crypto-validation.yml`: `contents: read` + `issues: write` (creates/closes GitHub issues on failure)
  • `release-check.yml`: `contents: read` + `issues: write` (creates/closes GitHub issues on stale releases)

Test plan

  • CI passes on this PR
  • No permission denied errors in workflow runs
  • GitHub Code Security alerts resolve after merge

Generated with Claude Code

rayketcham and others added 2 commits April 19, 2026 23:07
Co-Authored-By: Claude <noreply@anthropic.com>
The prior commit added contents:read to all 5 workflows but missed
issues:write for crypto-validation.yml and release-check.yml. Both
workflows use gh issue create/close, which requires issues:write.

Completes least-privilege permissions coverage for all CI workflows.

Co-Authored-By: Claude <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant