Summary
InfoSec plans to change the default GitHub Actions GITHUB_TOKEN from read/write to read-only. We should track the docs repos audit work needed to make sure workflows that write through the default token declare those permissions explicitly.
Preferred pattern:
permissions: {}
jobs:
some-job:
permissions:
contents: write
pull-requests: write
Or, when only read access is needed across the workflow:
permissions:
contents: read
The goal is to avoid granting broad workflow-level write permissions that could leak to future jobs.
Audit status so far
elastic/docs-actions: reviewed, no fixes needed.
elastic/elastic-agent: reviewed local workflows, no fixes needed for the default token.
elastic/opentelemetry: reviewed local workflows, no fixes needed for the default token.
elastic/integration-docs: reviewed local workflows, no fixes needed for the default token.
elastic/integrations: reviewed local workflows, no fixes needed for the default token.
elastic/docs-content: fixes opened.
elastic/docs: fixes opened.
elastic/docs.elastic.co: fixes opened.
Current fixes in flight
Next steps
- Merge the open fixes.
- Continue auditing any remaining docs repos that use GitHub Actions.
- Standardize on job-level write permissions when follow-up workflow edits are needed.
Summary
InfoSec plans to change the default GitHub Actions
GITHUB_TOKENfrom read/write to read-only. We should track the docs repos audit work needed to make sure workflows that write through the default token declare those permissions explicitly.Preferred pattern:
Or, when only read access is needed across the workflow:
The goal is to avoid granting broad workflow-level write permissions that could leak to future jobs.
Audit status so far
elastic/docs-actions: reviewed, no fixes needed.elastic/elastic-agent: reviewed local workflows, no fixes needed for the default token.elastic/opentelemetry: reviewed local workflows, no fixes needed for the default token.elastic/integration-docs: reviewed local workflows, no fixes needed for the default token.elastic/integrations: reviewed local workflows, no fixes needed for the default token.elastic/docs-content: fixes opened.elastic/docs: fixes opened.elastic/docs.elastic.co: fixes opened.Current fixes in flight
.github/workflows/update-kube-stack-version.yml.github/workflows/add-new-team-label.yml.github/workflows/patch-release-version-bump.yml.github/workflows/patch-release-version-bump.ymlNext steps