From 7a8cd2ed5d51f9bcbef6fd8ac0d855ca3aa16f03 Mon Sep 17 00:00:00 2001 From: jrfnl Date: Sat, 15 Aug 2026 19:56:32 +0200 Subject: [PATCH] GH Actions: set permissions for each workflow/job > Users frequently over-scope their workflow and job permissions, or set broad workflow-level permissions without realizing that all jobs inherit those permissions. > > Furthermore, users often don't realize that the _default_ `GITHUB_TOKEN` permissions can be very broad, meaning that workflows that don't configure any permissions at all can _still_ provide excessive credentials to their individual jobs. > > **Remediation** > In general, permissions should be declared as minimally as possible, and as close to their usage site as possible. > > In practice, this means that workflows should almost always set `permissions: {}` at the workflow level to disable all permissions by default, and then set specific job-level permissions as needed. Refs: * https://docs.zizmor.sh/audits/#excessive-permissions --- .github/workflows/qa.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/qa.yml b/.github/workflows/qa.yml index a1a1cda..ad162ee 100644 --- a/.github/workflows/qa.yml +++ b/.github/workflows/qa.yml @@ -15,8 +15,14 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +# Permissions should be configured at the job level. +permissions: {} + jobs: check: + permissions: + contents: read # To clone the repo. + name: 'Basic QA checks' runs-on: ubuntu-latest