chore(ci): limit GITHUB_TOKEN to read-only in ten workflows - #8054
Open
yhabib wants to merge 1 commit into
Open
Conversation
Ten workflows declare no permissions key. Their jobs hold the repository default GITHUB_TOKEN, which is read and write. None of them writes with that token. Add a workflow-level block with contents: read to each file. - The seven update-* workflows push and open pull requests with a GitHub App token from actions/create-github-app-token, not with GITHUB_TOKEN. - deploy-to-app.yaml deploys with the DFX_IDENTITY_PEM identity. It passes secrets.GITHUB_TOKEN to checkout_snsdemo and build_nns_dapp, and neither composite action uses the input. - docker-main.yaml only fills the docker cache. It pushes to no registry. - reproducible.yaml uploads and downloads artifacts inside one run. The actions cache and the artifact actions use the runtime token, not GITHUB_TOKEN, so contents: read is enough for them.
|
✅ No security or compliance issues detected. Reviewed everything up to b8bd621. Security Overview
Detected Code Changes
|
Contributor
There was a problem hiding this comment.
🟢 Approved
The change is a straightforward least-privilege tightening to contents: read and the reviewed workflows’ write operations are already performed using non-GITHUB_TOKEN credentials (e.g., GitHub App tokens) or runner-scoped artifact/cache mechanisms.
Pull request overview
This PR reduces the default GITHUB_TOKEN privileges across ten GitHub Actions workflows by explicitly setting workflow-level permissions to contents: read, aligning the token scope with the stated read-only usage of these jobs.
Changes:
- Added a workflow-level
permissions:block (contents: read) to ten workflows that previously relied on the repo default token permissions. - Ensured jobs continue to run without job-level permission overrides (workflow-level permissions apply uniformly).
File summaries
| File | Description |
|---|---|
| .github/workflows/update-snsdemo.yml | Sets workflow GITHUB_TOKEN to contents: read while PR creation continues via GitHub App token. |
| .github/workflows/update-sns-aggregator-response.yml | Limits default token to contents: read; PR creation remains via GitHub App token. |
| .github/workflows/update-rust.yml | Limits default token to contents: read; PR creation remains via GitHub App token. |
| .github/workflows/update-next.yml | Limits default token to contents: read; PR creation remains via GitHub App token. |
| .github/workflows/update-ic-cargo-deps.yaml | Limits default token to contents: read; PR creation remains via GitHub App token. |
| .github/workflows/update-didc.yml | Limits default token to contents: read; PR creation remains via GitHub App token. |
| .github/workflows/update-aggregator.yml | Limits default token to contents: read; PR creation remains via GitHub App token. |
| .github/workflows/reproducible.yaml | Limits default token to contents: read for reproducible build + artifact flow. |
| .github/workflows/docker-main.yaml | Limits default token to contents: read for docker buildx cache population. |
| .github/workflows/deploy-to-app.yaml | Limits default token to contents: read for the app deployment workflow. |
Review details
- Files reviewed: 10/10 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Ten workflows have no
permissions:key, so their jobs hold the repository defaultGITHUB_TOKEN, which is read and write. None of them writes to the repository with that token.Changes
permissions: contents: readblock to the ten workflows with nopermissionskey:deploy-to-app.yaml,docker-main.yaml,reproducible.yaml, and the sevenupdate-*bot workflows.permissionsblock, so the workflow-level block applies to all twelve jobs.Tests
yqthat all ten files declarecontents: readand no job carries its own block.Contents: readandMetadata: read: run 33928930943 (docker-main.yaml), run 33928933301 (update-snsdemo.yml), run 33928935284 (reproducible.yaml).mainand on the branch. The finding sets match exactly, 8 pre-existing findings on each side, so the new blocks add no schema error.deploy-to-app.yaml: it installs canisters on mainnet with real funds. Its onlyGITHUB_TOKENuse is the checkout insidecheckout_snsdemoandbuild_nns_dapp, which a sibling PR (chore(ci): add least-privilege permissions to build.yml and checks.yml #8053) already runs green undercontents: read../scripts/fmt-yaml --check: exit 0.Todos
deploy-to-app.yamllines 60 and 89 passtoken: ${{ secrets.GITHUB_TOKEN }}to two composite actions that never read it. Removing it also touchesbuild.ymlandnightly.yaml, so it needs its own item.