docs: apply deny-by-default permissions to all README examples#425
Open
timdittler wants to merge 2 commits intomainfrom
Open
docs: apply deny-by-default permissions to all README examples#425timdittler wants to merge 2 commits intomainfrom
timdittler wants to merge 2 commits intomainfrom
Conversation
Completes the per-job permissions pattern by denying all permissions at the workflow level by default, then granting only contents: read to the trufflehog job. Prevents consumers of the reusable workflow from inheriting permissive GITHUB_TOKEN defaults. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Applies deny-by-default permissions at the workflow level across every
template example (intro + 17 workflows). Per-job permissions already
existed and were left unchanged.
GitHub does not auto-zero workflow-level permissions when job-level
permissions are set; jobs without their own block still inherit the
workflow-level scope (or the repo default, often write-all). The
top-level {} ensures that any job without an explicit permissions block
gets nothing instead of the repo default, protecting consumers against
future job additions.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
timdittler
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
permissions: {}to every template example in the README (intro template + 17 workflows)permissions:blocks were already present and are left unchangedWhy
GitHub Actions does not auto-drop workflow-level permissions when you set job-level ones. Jobs without their own
permissions:block still inherit whatever is at the workflow level — or, if nothing is set, the repo/org defaultGITHUB_TOKENscope (often permissivewrite-all).Setting
permissions: {}at the workflow level is the "deny by default" belt that pairs with the per-job "grant specifically" suspenders. It protects consumers of these examples against:Originally triggered by the Copilot review on Staffbase/customer-control#3940, which flagged the missing top-level block.
Test plan