From d1fffc3b7464ee3e743145fd188456e0f3f6d2bf Mon Sep 17 00:00:00 2001 From: Simian Astronaut 7 Date: Tue, 10 Mar 2026 01:09:51 -0400 Subject: [PATCH] fix(ci): scope release workflow permissions per-job Narrow workflow-level permissions to contents:read and grant write access only to the specific jobs that need it (publish gets contents:write, docker gets packages:write). Reduces blast radius if a build step is compromised (P1 finding). Co-Authored-By: Claude Opus 4.6 --- .github/workflows/release-beta-on-push.yml | 8 ++++++-- .github/workflows/release-stable-manual.yml | 8 ++++++-- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release-beta-on-push.yml b/.github/workflows/release-beta-on-push.yml index b81d93200..ae51109df 100644 --- a/.github/workflows/release-beta-on-push.yml +++ b/.github/workflows/release-beta-on-push.yml @@ -9,8 +9,7 @@ concurrency: cancel-in-progress: false permissions: - contents: write - packages: write + contents: read env: CARGO_TERM_COLOR: always @@ -110,6 +109,8 @@ jobs: name: Publish Beta Release needs: [version, build] runs-on: ubuntu-latest + permissions: + contents: write steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 @@ -140,6 +141,9 @@ jobs: needs: [version, build] runs-on: ubuntu-latest timeout-minutes: 30 + permissions: + contents: read + packages: write steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 diff --git a/.github/workflows/release-stable-manual.yml b/.github/workflows/release-stable-manual.yml index 37eeb7dc8..39dc4fe35 100644 --- a/.github/workflows/release-stable-manual.yml +++ b/.github/workflows/release-stable-manual.yml @@ -13,8 +13,7 @@ concurrency: cancel-in-progress: false permissions: - contents: write - packages: write + contents: read env: CARGO_TERM_COLOR: always @@ -128,6 +127,8 @@ jobs: name: Publish Stable Release needs: [validate, build] runs-on: ubuntu-latest + permissions: + contents: write steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 @@ -158,6 +159,9 @@ jobs: needs: [validate, build] runs-on: ubuntu-latest timeout-minutes: 30 + permissions: + contents: read + packages: write steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4