Skip to content

Conversation

@brianaj
Copy link
Collaborator

@brianaj brianaj commented Dec 10, 2025

Summary

This PR adds explicit permissions to the CI workflow following security best practices and the principle of least privilege.

Context

This is based on external PR #1471 by @yugannkt. This fixes the 403 errors we've been seeing in CI when publishing test results and ensures all jobs have only the permissions they need.

Changes

  • Workflow-level: Set default contents: read as baseline
  • build job: contents: read, actions: write, security-events: write (for checkout, artifacts, CodeQL)
  • upload-event-file job: contents: read, actions: write (for uploading event file)
  • build-for-e2e-test job: contents: read, actions: write (for building and uploading binaries)
  • e2e-test job: contents: read, actions: write, checks: write (for downloading artifacts, uploading logs, publishing test results)
  • publish job: contents: write (for creating releases and committing release notes)

This follows the principle of least privilege by giving each job only the permissions it actually needs.

Fixes #1457

yugannkt and others added 3 commits December 8, 2025 14:29
- Added workflow-level default permissions (contents: read)
- Added job-level permissions for all jobs following least privilege:
  - build: contents:read, actions:write, security-events:write
  - upload-event-file: contents:read, actions:write
  - build-for-e2e-test: contents:read, actions:write
  - e2e-test: contents:read, actions:write, checks:write
  - publish: contents:write

Fixes #1457
@brianaj brianaj changed the title Add explicit permissions to CI workflow External PR 1471: Add explicit permissions to CI workflow Dec 10, 2025
@brianaj brianaj marked this pull request as ready for review December 10, 2025 00:17
Copilot AI review requested due to automatic review settings December 10, 2025 00:17
@brianaj brianaj enabled auto-merge December 10, 2025 00:18
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR adds explicit permissions to the CI workflow following GitHub Actions security best practices and the principle of least privilege. It sets a baseline contents: read permission at the workflow level and then grants specific permissions to each job based on their actual needs. This addresses 403 permission errors that were occurring during CI runs.

Key Changes

  • Workflow-level default permissions set to contents: read for baseline security
  • Job-specific permissions added for build, upload-event-file, build-for-e2e-test, e2e-test, and publish jobs
  • Each job receives only the minimum permissions required for its operations (artifacts, CodeQL, test results, releases)
Comments suppressed due to low confidence (1)

.github/workflows/CI.yml:164

  • The e2e-test job has duplicate permissions blocks. Lines 156-159 add new permissions, but lines 162-164 contain an existing permissions block. This will cause a YAML syntax error.

The permissions should be merged into a single block. Based on the PR description and the workflow's usage of publishing test results, the correct merged permissions should be:

permissions:
  contents: read
  actions: write
  checks: write

Remove the duplicate block at lines 162-164.

    permissions:
      contents: read
      actions: write
      checks: write
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.owner.login == 'github'
    needs: [build-for-e2e-test]
    permissions:
      checks: write
      contents: read

Copy link
Contributor

@mulana mulana left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@brianaj brianaj merged commit 6cb8e63 into main Dec 10, 2025
32 checks passed
@brianaj brianaj deleted the brianaj/external-pr-1471 branch December 10, 2025 01:12
@github-actions
Copy link

Code Coverage

Package Line Rate Branch Rate Complexity Health
ado2gh 72% 70% 712
Octoshift 83% 73% 1746
bbs2gh 83% 78% 663
gei 80% 71% 574
Summary 80% (7751 / 9630) 73% (1840 / 2527) 3695

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Please define actions workflow permissions

4 participants