CI: declares least-privilege token permissions

Jobs without a permissions block get the repository's default token scope, and reusable workflow calls pass the caller's grants straight through. Scopes are now derived from what each workflow actually does with the token: - every build workflow declares contents: read; none of them writes through the GITHUB_TOKEN. - build-linux-hosts.yml keeps security-events: write for the CodeQL upload; the other callers had that grant too but never upload scanning results, so they drop it. - build-windows-hosts.yml gets actions: read, which the SignPath action documents needing to read job details and download the unsigned artifact. - build-release.yml declares contents: write, matching the grant its caller already makes for creating the release. Runs that execute pull request code now hold a token that can do nothing but read the repository.
2026-09-12 10:22:12 +02:00 · 2026-08-04 17:04:34 +02:00
parent daf5421be7
commit b6d95a0ce5
19 changed files with 69 additions and 12 deletions
@@ -3,6 +3,9 @@ name: Reusable DragonFly amd64
 on:
  workflow_call:

+permissions:
+  contents: read
+
 jobs:
  build:
    runs-on: ubuntu-latest
@@ -3,6 +3,9 @@ name: Reusable FreeBSD amd64
 on:
  workflow_call:

+permissions:
+  contents: read
+
 jobs:
  build:
    runs-on: ubuntu-latest
@@ -3,6 +3,9 @@ name: Reusable Haiku amd64
 on:
  workflow_call:

+permissions:
+  contents: read
+
 jobs:
  build:
    runs-on: ubuntu-latest
@@ -3,6 +3,9 @@ name: Reusable Linux armv7l
 on:
  workflow_call:

+permissions:
+  contents: read
+
 env:
  CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }}

@@ -14,6 +14,10 @@ on:
        description: fastfetch version from linux host build
        value: ${{ jobs.build.outputs.ffversion }}

+permissions:
+  security-events: write
+  contents: read
+
 env:
  CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }}

@@ -3,6 +3,9 @@ name: Reusable Linux i686
 on:
  workflow_call:

+permissions:
+  contents: read
+
 env:
  CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }}

@@ -3,6 +3,9 @@ name: Reusable Linux loong64
 on:
  workflow_call:

+permissions:
+  contents: read
+
 env:
  CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }}

@@ -7,6 +7,9 @@ on:
        required: true
        type: string

+permissions:
+  contents: read
+
 env:
  CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }}

@@ -10,6 +10,9 @@ on:
        required: true
        type: string

+permissions:
+  contents: read
+
 env:
  CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }}

@@ -3,6 +3,9 @@ name: Reusable Musl amd64
 on:
  workflow_call:

+permissions:
+  contents: read
+
 env:
  CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }}

@@ -3,6 +3,9 @@ name: Reusable NetBSD amd64
 on:
  workflow_call:

+permissions:
+  contents: read
+
 jobs:
  build:
    runs-on: ubuntu-latest
@@ -3,6 +3,9 @@ name: Reusable No Features Test
 on:
  workflow_call:

+permissions:
+  contents: read
+
 env:
  CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }}

@@ -3,6 +3,9 @@ name: Reusable OmniOS amd64
 on:
  workflow_call:

+permissions:
+  contents: read
+
 jobs:
  build:
    runs-on: ubuntu-latest
@@ -3,6 +3,9 @@ name: Reusable OpenBSD amd64
 on:
  workflow_call:

+permissions:
+  contents: read
+
 jobs:
  build:
    runs-on: ubuntu-latest
@@ -7,6 +7,9 @@ on:
        required: true
        type: string

+permissions:
+  contents: write
+
 jobs:
  release:
    runs-on: ubuntu-latest
@@ -3,6 +3,9 @@ name: Reusable Solaris amd64
 on:
  workflow_call:

+permissions:
+  contents: read
+
 env:
  CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }}

@@ -3,6 +3,9 @@ name: Reusable Spellcheck
 on:
  workflow_call:

+permissions:
+  contents: read
+
 jobs:
  spellcheck:
    runs-on: ubuntu-latest
@@ -25,6 +25,12 @@ on:
        # still work; the signing step is skipped there anyway.
        required: false

+permissions:
+  contents: read
+  # The SignPath action reads job details and downloads the unsigned
+  # artifact with the workflow token.
+  actions: read
+
 env:
  CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }}

@@ -6,13 +6,14 @@ on:

 jobs:
  spellcheck:
+    permissions:
+      contents: read
    uses: ./.github/workflows/build-spellcheck.yml

  no-features-test:
    needs: spellcheck
    name: No-features-test
    permissions:
-      security-events: write
      contents: read
    uses: ./.github/workflows/build-no-features-test.yml

@@ -38,7 +39,6 @@ jobs:
    needs: no-features-test
    name: Linux-i686
    permissions:
-      security-events: write
      contents: read
    uses: ./.github/workflows/build-linux-i686.yml

@@ -46,7 +46,6 @@ jobs:
    needs: no-features-test
    name: Linux-armv7l
    permissions:
-      security-events: write
      contents: read
    uses: ./.github/workflows/build-linux-armv7l.yml

@@ -54,7 +53,6 @@ jobs:
    needs: no-features-test
    name: Linux-loong64
    permissions:
-      security-events: write
      contents: read
    uses: ./.github/workflows/build-linux-loong64.yml

@@ -62,7 +60,6 @@ jobs:
    needs: no-features-test
    name: Linux-${{ matrix.arch }}
    permissions:
-      security-events: write
      contents: read
    strategy:
      matrix:
@@ -77,13 +74,14 @@ jobs:
  musl-amd64:
    needs: no-features-test
    name: Musl-amd64
+    permissions:
+      contents: read
    uses: ./.github/workflows/build-musl-amd64.yml

  macos-hosts:
    needs: no-features-test
    name: macOS-${{ matrix.arch }}
    permissions:
-      security-events: write
      contents: read
    strategy:
      matrix:
@@ -100,18 +98,21 @@ jobs:
  omnios-amd64:
    needs: no-features-test
    name: OmniOS-amd64
+    permissions:
+      contents: read
    uses: ./.github/workflows/build-omnios-amd64.yml

  solaris-amd64:
    needs: no-features-test
    name: Solaris-amd64
+    permissions:
+      contents: read
    uses: ./.github/workflows/build-solaris-amd64.yml

  freebsd-amd64:
    needs: no-features-test
    name: FreeBSD-amd64
    permissions:
-      security-events: write
      contents: read
    uses: ./.github/workflows/build-freebsd-amd64.yml

@@ -119,7 +120,6 @@ jobs:
    needs: no-features-test
    name: OpenBSD-amd64
    permissions:
-      security-events: write
      contents: read
    uses: ./.github/workflows/build-openbsd-amd64.yml

@@ -127,7 +127,6 @@ jobs:
    needs: no-features-test
    name: NetBSD-amd64
    permissions:
-      security-events: write
      contents: read
    uses: ./.github/workflows/build-netbsd-amd64.yml

@@ -135,7 +134,6 @@ jobs:
    needs: no-features-test
    name: DragonFly-amd64
    permissions:
-      security-events: write
      contents: read
    uses: ./.github/workflows/build-dragonfly-amd64.yml

@@ -144,7 +142,6 @@ jobs:
    needs: no-features-test
    name: Haiku-amd64
    permissions:
-      security-events: write
      contents: read
    uses: ./.github/workflows/build-haiku-amd64.yml

@@ -152,8 +149,10 @@ jobs:
    needs: no-features-test
    name: Windows-${{ matrix.arch }}
    permissions:
-      security-events: write
      contents: read
+      # The SignPath action reads job details and downloads the unsigned
+      # artifact with the workflow token.
+      actions: read
    strategy:
      matrix:
        include: