From 06f3eb148d31a1b744ca3dadcd1700598db74ce1 Mon Sep 17 00:00:00 2001
From: Travis Leeden <travis.leeden@octopus.com>
Date: Fri, 16 Oct 2026 15:49:21 +1000
Subject: [PATCH] Harden Github workflows

---
 .github/workflows/codeql-analysis.yml   | 6 ++++++
 .github/workflows/integration-tests.yml | 8 ++++----
 .github/workflows/release-please.yml    | 3 +++
 3 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 6489f95d..423747cc 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -6,10 +6,16 @@ on:
       - integration/**
       - octopusdeploy/**
   pull_request:
+permissions:
+  contents: read
 jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index 14e2a4e8..2cdacd78 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -12,8 +12,12 @@ env:
   SA_PASSWORD: ${{ secrets.DB_IMAGE_SA_PASSWORD }}
   ADMIN_API_KEY: ${{ secrets.OD_IMAGE_ADMIN_API_KEY }}
   SERVER_URL: 'http://localhost:8080'
+permissions:
+  contents: read
 jobs:
   test:
+    # Fork PRs don't get the database, API key or licence secrets, so skip them rather than fail
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
     runs-on: ubuntu-latest
     services:
       sqlserver:
@@ -43,10 +47,6 @@ jobs:
           OCTOPUS__FeatureToggles__PartialUpdatesOnVariablesFeatureToggle: 'true'
         ports:
           - 8080:8080
-    # https://github.com/dorny/test-reporter/issues/168
-    permissions:
-      statuses: write
-      checks: write
     steps:
       - uses: actions/checkout@v4
         with:
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 8b534219..602219f7 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -3,6 +3,9 @@ on:
     branches:
       - main
 name: release-please
+# release-please authenticates with INTEGRATIONS_MD_BOT_TOKEN, so the default GITHUB_TOKEN needs nothing beyond read
+permissions:
+  contents: read
 jobs:
   release-please-release:
     runs-on: ubuntu-latest