From 66fdaab8e10c0452621dd625c4df4ca5bed76234 Mon Sep 17 00:00:00 2001 From: jrfnl Date: Sun, 21 Jun 2026 03:40:21 +0200 Subject: [PATCH] GH Actions: set permissions for each workflow/job > Users frequently over-scope their workflow and job permissions, or set broad workflow-level permissions without realizing that all jobs inherit those permissions. > > Furthermore, users often don't realize that the _default_ `GITHUB_TOKEN` permissions can be very broad, meaning that workflows that don't configure any permissions at all can _still_ provide excessive credentials to their individual jobs. > > **Remediation** > In general, permissions should be declared as minimally as possible, and as close to their usage site as possible. > > In practice, this means that workflows should almost always set `permissions: {}` at the workflow level to disable all permissions by default, and then set specific job-level permissions as needed. Refs: * https://docs.zizmor.sh/audits/#excessive-permissions --- .github/workflows/basic-qa.yml | 18 ++++++++++++++++++ .github/workflows/label-merge-conflicts.yml | 6 ++++++ .github/workflows/label-new-prs.yml | 9 +++++++++ .github/workflows/label-remove-outdated.yml | 15 +++++++++++++++ .github/workflows/pr-comment.yml | 10 ++++++---- .github/workflows/publish-wiki.yml | 6 ++++-- 6 files changed, 58 insertions(+), 6 deletions(-) diff --git a/.github/workflows/basic-qa.yml b/.github/workflows/basic-qa.yml index 05e11cd..90dc48c 100644 --- a/.github/workflows/basic-qa.yml +++ b/.github/workflows/basic-qa.yml @@ -13,18 +13,30 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: false +# Permissions should be configured at the job level. +permissions: {} + jobs: yamllint: + permissions: + contents: read # To clone the repo. + name: 'Lint Yaml' uses: PHPCSStandards/.github/.github/workflows/reusable-yamllint.yml@c535983699986d1c538d4e47f33e813fcfbcc8a0 # v1.2.2 with: strict: true markdownlint: + permissions: + contents: read # To clone the repo. + name: 'Lint Markdown' uses: PHPCSStandards/.github/.github/workflows/reusable-markdownlint.yml@c535983699986d1c538d4e47f33e813fcfbcc8a0 # v1.2.2 linkcheck: + permissions: + contents: read # To clone the repo. + name: "Check links" runs-on: ubuntu-latest @@ -52,6 +64,9 @@ jobs: fail: true spellcheck: + permissions: + contents: read # To clone the repo. + # Config file: .cspell.yml name: Spellcheck @@ -79,6 +94,9 @@ jobs: incremental_files_only: false shellcheck: + permissions: + contents: read # To clone the repo. + name: 'ShellCheck' runs-on: ubuntu-latest diff --git a/.github/workflows/label-merge-conflicts.yml b/.github/workflows/label-merge-conflicts.yml index d67e3cf..5faac70 100644 --- a/.github/workflows/label-merge-conflicts.yml +++ b/.github/workflows/label-merge-conflicts.yml @@ -12,8 +12,14 @@ on: - synchronize - reopened +# Permissions should be configured at the job level. +permissions: {} + jobs: check-prs: + permissions: + pull-requests: write # To add and remove PR labels. + if: github.repository_owner == 'PHPCSStandards' name: Check PRs for merge conflicts diff --git a/.github/workflows/label-new-prs.yml b/.github/workflows/label-new-prs.yml index f625bed..551906c 100644 --- a/.github/workflows/label-new-prs.yml +++ b/.github/workflows/label-new-prs.yml @@ -16,8 +16,14 @@ on: - '.github/workflows/label-new-prs.yml' - '.github/labeler.yml' +# Permissions should be configured at the job level. +permissions: {} + jobs: label-new-prs: + permissions: + pull-requests: write # To add PR labels. + if: github.repository_owner == 'PHPCSStandards' && github.event_name == 'pull_request_target' name: Add labels to new PRs @@ -30,6 +36,9 @@ jobs: GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}" validate-labeler-worflow: + permissions: + contents: read # To clone the repo. + if: github.repository_owner == 'PHPCSStandards' && github.event_name == 'pull_request' && github.event.pull_request.merged == false name: Validate changes to Labeler logic diff --git a/.github/workflows/label-remove-outdated.yml b/.github/workflows/label-remove-outdated.yml index 4558532..e045726 100644 --- a/.github/workflows/label-remove-outdated.yml +++ b/.github/workflows/label-remove-outdated.yml @@ -10,8 +10,14 @@ on: - closed - review_requested +# Permissions should be configured at the job level. +permissions: {} + jobs: on-issue-close: + permissions: + issues: write # To remove issue labels. + if: github.repository_owner == 'PHPCSStandards' && github.event.issue.state == 'closed' name: Clean up labels on issue close @@ -29,6 +35,9 @@ jobs: Status: triage on-pr-review-request: + permissions: + pull-requests: write # To remove PR labels. + if: github.repository_owner == 'PHPCSStandards' && github.event.action == 'review_requested' name: "Clean up labels on PR (re-)review request" @@ -42,6 +51,9 @@ jobs: Status: awaiting feedback on-pr-merge: + permissions: + pull-requests: write # To remove PR labels. + if: github.repository_owner == 'PHPCSStandards' && github.event.pull_request.merged == true name: Clean up labels on PR merge @@ -61,6 +73,9 @@ jobs: Status: wait for PHPCS 4.0.0 release on-pr-close: + permissions: + pull-requests: write # To remove PR labels. + # yamllint disable-line rule:line-length if: github.repository_owner == 'PHPCSStandards' && github.event_name == 'pull_request_target' && github.event.action == 'closed' && github.event.pull_request.merged == false diff --git a/.github/workflows/pr-comment.yml b/.github/workflows/pr-comment.yml index 18e79b9..8db9969 100644 --- a/.github/workflows/pr-comment.yml +++ b/.github/workflows/pr-comment.yml @@ -12,17 +12,19 @@ concurrency: # or the commit hash for any other events. group: ${{ github.workflow }}-${{ github.sha }} +# Permissions should be configured at the job level. +permissions: {} + jobs: artifact-review-comment: + permissions: + pull-requests: write # To add the PR comment. + if: > github.repository == 'PHPCSStandards/PHP_CodeSniffer-documentation' && github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success' - permissions: - # Needed for the PR comment. - pull-requests: write - name: Comment on a pull request runs-on: ubuntu-latest diff --git a/.github/workflows/publish-wiki.yml b/.github/workflows/publish-wiki.yml index 47f3014..192d2d5 100644 --- a/.github/workflows/publish-wiki.yml +++ b/.github/workflows/publish-wiki.yml @@ -30,11 +30,13 @@ concurrency: group: "publish-wiki" cancel-in-progress: false +# Permissions should be configured at the job level. +permissions: {} + jobs: publish-wiki: permissions: - # Needed for the commit to the wiki. - contents: write + contents: write # To clone the repo and commit to the wiki. if: github.repository == 'PHPCSStandards/PHP_CodeSniffer-documentation'