From b3bcace9dda2c96968f3c070877cab10350d8c2c Mon Sep 17 00:00:00 2001 From: Sunita Prajapati Date: Wed, 23 Sep 2026 15:23:43 +0530 Subject: [PATCH] ci: enforce lockfile and scope permissions in publish-e2e-cli MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Switch the e2e-cli build to `npm ci` so the committed package-lock.json is enforced instead of silently drifting on push-to-master and the monthly cron run. Add a top-level read-only `permissions` block to drop the default write-scoped GITHUB_TOKEN. Skipped build provenance attestation: it requires id-token and attestations write scopes, and nothing consumes the uploaded artifact today — e2e-tests.yml rebuilds e2e-cli from source. --- .github/workflows/publish-e2e-cli.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish-e2e-cli.yml b/.github/workflows/publish-e2e-cli.yml index ee0d7de4c..7e778ae6f 100644 --- a/.github/workflows/publish-e2e-cli.yml +++ b/.github/workflows/publish-e2e-cli.yml @@ -15,6 +15,9 @@ on: - cron: '0 0 1 * *' workflow_dispatch: +permissions: + contents: read + jobs: publish: runs-on: ubuntu-latest-large @@ -30,7 +33,7 @@ jobs: - name: Build e2e-cli working-directory: e2e-cli run: | - npm install + npm ci npm run build - name: Prepare artifact