From b6d95a0ce51634cd7938a8ac480066ba77b74f92 Mon Sep 17 00:00:00 2001 From: Thibaud-Vdb Date: Tue, 4 Aug 2026 17:04:34 +0200 Subject: [PATCH] CI: declares least-privilege token permissions Jobs without a permissions block get the repository's default token scope, and reusable workflow calls pass the caller's grants straight through. Scopes are now derived from what each workflow actually does with the token: - every build workflow declares contents: read; none of them writes through the GITHUB_TOKEN. - build-linux-hosts.yml keeps security-events: write for the CodeQL upload; the other callers had that grant too but never upload scanning results, so they drop it. - build-windows-hosts.yml gets actions: read, which the SignPath action documents needing to read job details and download the unsigned artifact. - build-release.yml declares contents: write, matching the grant its caller already makes for creating the release. Runs that execute pull request code now hold a token that can do nothing but read the repository. --- .github/workflows/build-dragonfly-amd64.yml | 3 +++ .github/workflows/build-freebsd-amd64.yml | 3 +++ .github/workflows/build-haiku-amd64.yml | 3 +++ .github/workflows/build-linux-armv7l.yml | 3 +++ .github/workflows/build-linux-hosts.yml | 4 ++++ .github/workflows/build-linux-i686.yml | 3 +++ .github/workflows/build-linux-loong64.yml | 3 +++ .github/workflows/build-linux-vms.yml | 3 +++ .github/workflows/build-macos-hosts.yml | 3 +++ .github/workflows/build-musl-amd64.yml | 3 +++ .github/workflows/build-netbsd-amd64.yml | 3 +++ .github/workflows/build-no-features-test.yml | 3 +++ .github/workflows/build-omnios-amd64.yml | 3 +++ .github/workflows/build-openbsd-amd64.yml | 3 +++ .github/workflows/build-release.yml | 3 +++ .github/workflows/build-solaris-amd64.yml | 3 +++ .github/workflows/build-spellcheck.yml | 3 +++ .github/workflows/build-windows-hosts.yml | 6 +++++ .github/workflows/ci.yml | 23 ++++++++++---------- 19 files changed, 69 insertions(+), 12 deletions(-) diff --git a/.github/workflows/build-dragonfly-amd64.yml b/.github/workflows/build-dragonfly-amd64.yml index c4b39ecc7..c036d0d9d 100644 --- a/.github/workflows/build-dragonfly-amd64.yml +++ b/.github/workflows/build-dragonfly-amd64.yml @@ -3,6 +3,9 @@ name: Reusable DragonFly amd64 on: workflow_call: +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest diff --git a/.github/workflows/build-freebsd-amd64.yml b/.github/workflows/build-freebsd-amd64.yml index ad65c808d..b75d67be8 100644 --- a/.github/workflows/build-freebsd-amd64.yml +++ b/.github/workflows/build-freebsd-amd64.yml @@ -3,6 +3,9 @@ name: Reusable FreeBSD amd64 on: workflow_call: +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest diff --git a/.github/workflows/build-haiku-amd64.yml b/.github/workflows/build-haiku-amd64.yml index 8b9b6cacf..b85fef26e 100644 --- a/.github/workflows/build-haiku-amd64.yml +++ b/.github/workflows/build-haiku-amd64.yml @@ -3,6 +3,9 @@ name: Reusable Haiku amd64 on: workflow_call: +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest diff --git a/.github/workflows/build-linux-armv7l.yml b/.github/workflows/build-linux-armv7l.yml index 4a1f017d6..981ab48c4 100644 --- a/.github/workflows/build-linux-armv7l.yml +++ b/.github/workflows/build-linux-armv7l.yml @@ -3,6 +3,9 @@ name: Reusable Linux armv7l on: workflow_call: +permissions: + contents: read + env: CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }} diff --git a/.github/workflows/build-linux-hosts.yml b/.github/workflows/build-linux-hosts.yml index e724146af..bcd5069c4 100644 --- a/.github/workflows/build-linux-hosts.yml +++ b/.github/workflows/build-linux-hosts.yml @@ -14,6 +14,10 @@ on: description: fastfetch version from linux host build value: ${{ jobs.build.outputs.ffversion }} +permissions: + security-events: write + contents: read + env: CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }} diff --git a/.github/workflows/build-linux-i686.yml b/.github/workflows/build-linux-i686.yml index 3f46344f8..985b3b089 100644 --- a/.github/workflows/build-linux-i686.yml +++ b/.github/workflows/build-linux-i686.yml @@ -3,6 +3,9 @@ name: Reusable Linux i686 on: workflow_call: +permissions: + contents: read + env: CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }} diff --git a/.github/workflows/build-linux-loong64.yml b/.github/workflows/build-linux-loong64.yml index 7dea51795..4771515cb 100644 --- a/.github/workflows/build-linux-loong64.yml +++ b/.github/workflows/build-linux-loong64.yml @@ -3,6 +3,9 @@ name: Reusable Linux loong64 on: workflow_call: +permissions: + contents: read + env: CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }} diff --git a/.github/workflows/build-linux-vms.yml b/.github/workflows/build-linux-vms.yml index 7a196e006..e61a2c52c 100644 --- a/.github/workflows/build-linux-vms.yml +++ b/.github/workflows/build-linux-vms.yml @@ -7,6 +7,9 @@ on: required: true type: string +permissions: + contents: read + env: CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }} diff --git a/.github/workflows/build-macos-hosts.yml b/.github/workflows/build-macos-hosts.yml index 766fad0c9..66c1666b7 100644 --- a/.github/workflows/build-macos-hosts.yml +++ b/.github/workflows/build-macos-hosts.yml @@ -10,6 +10,9 @@ on: required: true type: string +permissions: + contents: read + env: CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }} diff --git a/.github/workflows/build-musl-amd64.yml b/.github/workflows/build-musl-amd64.yml index da02bcba2..07fad3a7f 100644 --- a/.github/workflows/build-musl-amd64.yml +++ b/.github/workflows/build-musl-amd64.yml @@ -3,6 +3,9 @@ name: Reusable Musl amd64 on: workflow_call: +permissions: + contents: read + env: CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }} diff --git a/.github/workflows/build-netbsd-amd64.yml b/.github/workflows/build-netbsd-amd64.yml index 18b5f33a6..9a6283a06 100644 --- a/.github/workflows/build-netbsd-amd64.yml +++ b/.github/workflows/build-netbsd-amd64.yml @@ -3,6 +3,9 @@ name: Reusable NetBSD amd64 on: workflow_call: +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest diff --git a/.github/workflows/build-no-features-test.yml b/.github/workflows/build-no-features-test.yml index a301549d2..fadefe8b9 100644 --- a/.github/workflows/build-no-features-test.yml +++ b/.github/workflows/build-no-features-test.yml @@ -3,6 +3,9 @@ name: Reusable No Features Test on: workflow_call: +permissions: + contents: read + env: CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }} diff --git a/.github/workflows/build-omnios-amd64.yml b/.github/workflows/build-omnios-amd64.yml index d2e393191..a473b0817 100644 --- a/.github/workflows/build-omnios-amd64.yml +++ b/.github/workflows/build-omnios-amd64.yml @@ -3,6 +3,9 @@ name: Reusable OmniOS amd64 on: workflow_call: +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest diff --git a/.github/workflows/build-openbsd-amd64.yml b/.github/workflows/build-openbsd-amd64.yml index c3240eb36..a22919f69 100644 --- a/.github/workflows/build-openbsd-amd64.yml +++ b/.github/workflows/build-openbsd-amd64.yml @@ -3,6 +3,9 @@ name: Reusable OpenBSD amd64 on: workflow_call: +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml index 7af70e83d..c5ca7071a 100644 --- a/.github/workflows/build-release.yml +++ b/.github/workflows/build-release.yml @@ -7,6 +7,9 @@ on: required: true type: string +permissions: + contents: write + jobs: release: runs-on: ubuntu-latest diff --git a/.github/workflows/build-solaris-amd64.yml b/.github/workflows/build-solaris-amd64.yml index 806c64df2..c8e625620 100644 --- a/.github/workflows/build-solaris-amd64.yml +++ b/.github/workflows/build-solaris-amd64.yml @@ -3,6 +3,9 @@ name: Reusable Solaris amd64 on: workflow_call: +permissions: + contents: read + env: CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }} diff --git a/.github/workflows/build-spellcheck.yml b/.github/workflows/build-spellcheck.yml index da6443e28..e57c92218 100644 --- a/.github/workflows/build-spellcheck.yml +++ b/.github/workflows/build-spellcheck.yml @@ -3,6 +3,9 @@ name: Reusable Spellcheck on: workflow_call: +permissions: + contents: read + jobs: spellcheck: runs-on: ubuntu-latest diff --git a/.github/workflows/build-windows-hosts.yml b/.github/workflows/build-windows-hosts.yml index 6c3007d71..18708f55f 100644 --- a/.github/workflows/build-windows-hosts.yml +++ b/.github/workflows/build-windows-hosts.yml @@ -25,6 +25,12 @@ on: # still work; the signing step is skipped there anyway. required: false +permissions: + contents: read + # The SignPath action reads job details and downloads the unsigned + # artifact with the workflow token. + actions: read + env: CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ee3fc872e..0081e62d8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,13 +6,14 @@ on: jobs: spellcheck: + permissions: + contents: read uses: ./.github/workflows/build-spellcheck.yml no-features-test: needs: spellcheck name: No-features-test permissions: - security-events: write contents: read uses: ./.github/workflows/build-no-features-test.yml @@ -38,7 +39,6 @@ jobs: needs: no-features-test name: Linux-i686 permissions: - security-events: write contents: read uses: ./.github/workflows/build-linux-i686.yml @@ -46,7 +46,6 @@ jobs: needs: no-features-test name: Linux-armv7l permissions: - security-events: write contents: read uses: ./.github/workflows/build-linux-armv7l.yml @@ -54,7 +53,6 @@ jobs: needs: no-features-test name: Linux-loong64 permissions: - security-events: write contents: read uses: ./.github/workflows/build-linux-loong64.yml @@ -62,7 +60,6 @@ jobs: needs: no-features-test name: Linux-${{ matrix.arch }} permissions: - security-events: write contents: read strategy: matrix: @@ -77,13 +74,14 @@ jobs: musl-amd64: needs: no-features-test name: Musl-amd64 + permissions: + contents: read uses: ./.github/workflows/build-musl-amd64.yml macos-hosts: needs: no-features-test name: macOS-${{ matrix.arch }} permissions: - security-events: write contents: read strategy: matrix: @@ -100,18 +98,21 @@ jobs: omnios-amd64: needs: no-features-test name: OmniOS-amd64 + permissions: + contents: read uses: ./.github/workflows/build-omnios-amd64.yml solaris-amd64: needs: no-features-test name: Solaris-amd64 + permissions: + contents: read uses: ./.github/workflows/build-solaris-amd64.yml freebsd-amd64: needs: no-features-test name: FreeBSD-amd64 permissions: - security-events: write contents: read uses: ./.github/workflows/build-freebsd-amd64.yml @@ -119,7 +120,6 @@ jobs: needs: no-features-test name: OpenBSD-amd64 permissions: - security-events: write contents: read uses: ./.github/workflows/build-openbsd-amd64.yml @@ -127,7 +127,6 @@ jobs: needs: no-features-test name: NetBSD-amd64 permissions: - security-events: write contents: read uses: ./.github/workflows/build-netbsd-amd64.yml @@ -135,7 +134,6 @@ jobs: needs: no-features-test name: DragonFly-amd64 permissions: - security-events: write contents: read uses: ./.github/workflows/build-dragonfly-amd64.yml @@ -144,7 +142,6 @@ jobs: needs: no-features-test name: Haiku-amd64 permissions: - security-events: write contents: read uses: ./.github/workflows/build-haiku-amd64.yml @@ -152,8 +149,10 @@ jobs: needs: no-features-test name: Windows-${{ matrix.arch }} permissions: - security-events: write contents: read + # The SignPath action reads job details and downloads the unsigned + # artifact with the workflow token. + actions: read strategy: matrix: include: