ci(workflows): add least-privilege permissions to nightly.yaml and tag.yaml - #8055
ci(workflows): add least-privilege permissions to nightly.yaml and tag.yaml#8055yhabib wants to merge 1 commit into
Conversation
Both workflows ran with the repository default GITHUB_TOKEN. That token holds write access in every scope. Each workflow now names only the scope that it needs. nightly.yaml gets a workflow-level contents: read block. The tag-main job gets a job-level contents: write block, because it pushes a nightly-* tag and it publishes a release. The nightly-passes job inherits read access only. tag.yaml gets a workflow-level contents: write block. Its one job pushes the tip tag.
|
✅ No security or compliance issues detected. Reviewed everything up to e75f759. Security Overview
Detected Code Changes
|
There was a problem hiding this comment.
🟡 Changes recommended
The permissions change needs to be validated via an actual GitHub Actions run (as noted in the PR description) to confirm the jobs still succeed with the reduced token scopes.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR tightens GitHub Actions GITHUB_TOKEN privileges for the repo’s tagging and nightly release workflows by explicitly setting permissions: so jobs don’t run with broad default write access.
Changes:
- Add workflow-level
permissions: contents: writeto.github/workflows/tag.yamlto allow pushing thetiptag. - Add workflow-level
permissions: contents: readto.github/workflows/nightly.yaml, and elevate only thetag-mainjob tocontents: writefor tag/release publication.
File summaries
| File | Description |
|---|---|
| .github/workflows/tag.yaml | Grants contents: write so the workflow can push the tip tag. |
| .github/workflows/nightly.yaml | Defaults to contents: read, raising only the tagging/release job to contents: write. |
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
This live run needs a real Nightly Publication run. Today's nightly release does not exist yet (checked 2026-09-05T00:26Z UTC). A run on the |
There was a problem hiding this comment.
🟢 Approved
The changes are minimal, valid YAML, and the new permissions align with the workflows’ documented tag/release behavior without introducing functional code changes.
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
Motivation
.github/workflows/nightly.yamland.github/workflows/tag.yamldeclare nopermissions:key. Both run with the defaultGITHUB_TOKEN, which is read and write for every scope. They only push a tag and publish a release.This is part 2 of a 4-part split. The other parts give the same treatment to other workflow files.
Changes
contents: readblock tonightly.yaml, and a job-levelcontents: writeblock to thetag-mainjob.contents: writeblock totag.yaml.Tests
./scripts/fmt-yaml --check. It exits 0 with no output.build_nns_dapp,release_nns_dapp,checkout_snsdemo,needs_success). EveryGITHUB_TOKENuser works under the scope its job now gets.nightlybranch, watch theNightly Publicationrun, read the job setup log for the resolved token permissions, then delete the branch). The build stage could not push a branch, so this smoke test still needs to run before merge.Todos
nightlybranch, confirm theNightly Publicationrun showsContents: writefortag-mainandContents: readfornightly-passesin the job setup log, confirm the run is green, then delete thenightlybranch.git ls-remote origin refs/tags/tipmatches the merge commit, and confirm the nextnightly-*tag has a public release.