Skip to content

Track explicit GITHUB_TOKEN permissions for a read-only default #187

Description

@theletterf

Summary

InfoSec plans to change the default GitHub Actions GITHUB_TOKEN from read/write to read-only. We should track the docs repos audit work needed to make sure workflows that write through the default token declare those permissions explicitly.

Preferred pattern:

permissions: {}

jobs:
  some-job:
    permissions:
      contents: write
      pull-requests: write

Or, when only read access is needed across the workflow:

permissions:
  contents: read

The goal is to avoid granting broad workflow-level write permissions that could leak to future jobs.

Audit status so far

  • elastic/docs-actions: reviewed, no fixes needed.
  • elastic/elastic-agent: reviewed local workflows, no fixes needed for the default token.
  • elastic/opentelemetry: reviewed local workflows, no fixes needed for the default token.
  • elastic/integration-docs: reviewed local workflows, no fixes needed for the default token.
  • elastic/integrations: reviewed local workflows, no fixes needed for the default token.
  • elastic/docs-content: fixes opened.
  • elastic/docs: fixes opened.
  • elastic/docs.elastic.co: fixes opened.

Current fixes in flight

Next steps

  1. Merge the open fixes.
  2. Continue auditing any remaining docs repos that use GitHub Actions.
  3. Standardize on job-level write permissions when follow-up workflow edits are needed.

Metadata

Metadata

Assignees

Labels

Type

Fields

No fields configured for Task.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions