Skip to content

Comments

Added missing required workflow permissions#78

Closed
kartykp wants to merge 2 commits intomasterfrom
kartykp/alert-permission-fix
Closed

Added missing required workflow permissions#78
kartykp wants to merge 2 commits intomasterfrom
kartykp/alert-permission-fix

Conversation

@kartykp
Copy link
Contributor

@kartykp kartykp commented Jan 14, 2026

Ref: https://github.com/github/npm/issues/13757

This PR adds minimal required permissions to GitHub Actions workflows to follow the principle of least privilege and improve repository security. Previously, workflows were running with default permissions which could grant unnecessary access.

Changes Made

Workflow Permission Updates:

  • [test.yml]: Added contents: read - Required for shared workflow to access repository code and configuration files
  • [deploy.yml]: Added contents: read and deployments: write - Required for reading deployment configurations and creating GitHub deployments
  • [codeql-analysis.yml]: Added actions: read, contents: read and security-events: write - Required for reading source code and uploading security scan results

Security Benefits

  • ✅ Principle of least privilege: Each workflow now has only the minimal permissions needed for its functionality
  • ✅ Reduced attack surface: Workflows cannot access or modify resources they don't need
  • ✅ Explicit permissions: Clear documentation of what each workflow can access
  • ✅ Security compliance: Follows GitHub's security best practices for Actions

@kartykp kartykp self-assigned this Jan 14, 2026
@kartykp kartykp closed this Jan 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant