Declare explicit read-only token permissions in the Go workflow
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 72/100
Research direction
Start with .github/workflows/go.yml and add a top-level permissions: block granting contents: read, keeping the triggers, concurrency settings and lint and test jobs unchanged. Check each job's steps to confirm none needs more than read access, and document any extra permission you add. Done when workflow validation passes and the lint and test jobs still succeed.
Written by the indexing model from the issue text.
Description
Summary
Declare explicit least-privilege GITHUB_TOKEN permissions in .github/workflows/go.yml as a separate change from the default-branch transition.
The workflow currently has no explicit permissions: block and therefore inherits the repository or organization default. Those defaults have not been verified, so broader-than-needed access is not confirmed. Adding main to the push filter does not change token permissions.
Required changes
- Review the token permissions needed by checkout, Go setup, linting, unit tests, and integration tests.
- Add a top-level
permissions:block grantingcontents: read, unless verification identifies another required permission. - Document any additional permission and its reason.
- Preserve the existing triggers, concurrency configuration, and test jobs.
Acceptance criteria
- The workflow declares explicit minimum token permissions.
- Workflow validation passes.
- The lint and test jobs succeed with the declared permissions.
- No branch-transition configuration is changed as part of this hardening.
Context
Requested by @aramprice as follow-up work outside PR #376.
- Dominant language
- Go
- Stars
- 35
- Forks
- 68
- Avg merge
- 3d 13h
- Merged PRs (30d)
- 8
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from cloudfoundry/bosh-openstack-cpi-release
-
Difficulty 3/5 1-2 days Newbie friendliness 66/100
-
Difficulty 4/5 3-5 days Newbie friendliness 64/100
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
All issues in cloudfoundry/bosh-openstack-cpi-release
Similar issues
-
CLI: `describe <ns>.<table>` reports "namespace does not exist" when only the table is missingPossibly taken @Shruthirdy claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
apache/iceberg-go#2423 ·
Maintainers usually reply within 2 days
-
post-v4
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 80/100
rishikanthc/Scriberr#506 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
microsoft/TypeScript#65290 ·
Maintainers usually reply within 1 day
-
[Bug] rollingUpdatePartition panics when live StatefulSet replicas sit far below the desired countOpen
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
sgl-project/rbg#547 ·
Maintainers usually reply within 1 day