Please define actions workflow permissions

Open
  • Is something wrong?
#329 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
62/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Stale
Tech stack
github-actions
Domain
ci-cd, security

Research direction

Start by reading .github/workflows/lighthouse.yml, .github/workflows/nodejs.yml, and .github/workflows/publish.yml, then inventory each workflow's jobs and uses entries. Determine the minimum permissions required for each workflow, add explicit least-privilege blocks while preserving formatting, and verify the YAML syntax and workflow requirements remain valid.

Written by the indexing model from the issue text.

Description

Workflow permissions improvement

There are 3 workflow files that are currently lacking explicit permissions

Affected Workflow Files

The following workflow files need permissions to be explicitly defined:

Request

Ensure permissions are explicitly defined. Below are Copilot prompts/instructions if you would like Copilot's assistance with addressing this.

GitHub Copilot Assignment Prompts and Context

Task: Add explicit permissions to GitHub Actions workflow files that are currently missing them.

Scope: Update the workflow files listed above to include appropriate permissions: blocks.

Analysis Methodology:

  1. Gather Current State: Check if the workflow has any existing permissions defined
  2. Inventory Workflow Actions:
    • Actions performed directly by the workflow
    • API calls made by the workflow
    • External actions included via uses: statements
  3. Determine Required Permissions: Map each action to its minimum required permissions
  4. Synthesize Minimal Permissions: Create permissions block with only necessary permissions

Requirements:

  1. Add a permissions: block to each workflow file that doesn't have one
  2. Start with contents: read as the minimum permission
  3. Add additional permissions only if the workflow actually needs them based on the actions it performs
  4. Place the permissions: block at the job level or workflow level as appropriate
  5. Ensure the syntax is correct and follows YAML formatting
  6. Maintain existing content formatting, including indentation and comments

Files to modify: See the list of affected workflow files above.

Acceptance criteria:

  • All listed workflow files have explicit permissions defined
  • Permissions follow the principle of least privilege
  • YAML syntax is valid
  • Workflows still function correctly after changes

Copilot Instructions:

Please create a pull request that adds appropriate permissions: blocks to each of the workflow files listed above. Analyze each workflow to determine the minimum permissions required based on the actions it performs, and add only those necessary permissions.

Dominant language
TypeScript
Stars
1.4k
Forks
61
Avg merge
1d 15h
Merged PRs (30d)
8

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/catalyst

All issues in github/catalyst

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.