From 983fe9ad721d34290837801f548f1a8ccdcaeec5 Mon Sep 17 00:00:00 2001 From: Alexis Lefebvre Date: Tue, 4 Aug 2026 14:55:27 +0200 Subject: [PATCH 1/2] ci: restrict default token permissions to read-only Without an explicit block, the automatic token inherits whatever the repository or organisation default grants, which can include write scopes. Neither workflow writes anything back to GitHub, so a compromised step or action had more reach than the work required. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/ci.yml | 3 +++ .github/workflows/guides.yml | 3 +++ 2 files changed, 6 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index bc2c6df9758..2e90a18c485 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,6 +19,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} cancel-in-progress: true +permissions: + contents: read + env: COMPOSER_TOKEN: ${{ secrets.GITHUB_TOKEN }} COMPOSER_ROOT_VERSION: "4.3.x-dev" diff --git a/.github/workflows/guides.yml b/.github/workflows/guides.yml index 7ba7956730d..07b9270bd4e 100644 --- a/.github/workflows/guides.yml +++ b/.github/workflows/guides.yml @@ -8,6 +8,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} cancel-in-progress: true +permissions: + contents: read + env: COMPOSER_TOKEN: ${{ secrets.GITHUB_TOKEN }} COVERAGE: '0' From fd973c4bd20d42a1f63a206374cfb7f4576d05c4 Mon Sep 17 00:00:00 2001 From: Alexis Lefebvre Date: Tue, 4 Aug 2026 15:05:35 +0200 Subject: [PATCH 2/2] ci: restrict release pipeline token permissions to read-only Every job here authenticates through a GitHub App token, so the automatic token is never used: the write grant it carried could not authorise the pushes to the component repositories anyway, since its scope is limited to this repository. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/release.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 187e44039c9..d2871b3d975 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -14,12 +14,13 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: + contents: read + jobs: split: name: Subtree Split runs-on: ubuntu-latest - permissions: - contents: write steps: - name: Generate App Token id: generate_token