Workflows do not declare least-privilege token permissions

Open Beginner friendly
#61 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
github-actions
Domain
ci-cd, security

Research direction

Start by reviewing every workflow under .github/workflows and identify the permissions needed by each top-level or job-level workflow. Confirm the GITHUB_TOKEN scope for push-triggered jobs, then verify that explicit least-privilege permissions are declared and the workflows still pass their existing checks.

Written by the indexing model from the issue text.

Description

Steps to reproduce

  1. Open the workflow files under .github/workflows.
  2. Check for a top-level or job-level permissions declaration.
  3. Inspect the token available to push-triggered jobs.

Actual result

The workflows inherit the repository or organization default GITHUB_TOKEN scope. This makes the authority of the CI jobs implicit and can grant unnecessary write capabilities.

Expected result

Declare explicit least-privilege permissions, defaulting to read-only access.

Evidence

The workflow files contain no permissions block.

Dominant language
Java
Stars
5
Forks
3
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from objectionary/eo-http

All issues in objectionary/eo-http

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.