Skip to content

Add minimum token permissions for all github workflow files #990

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jul 2, 2025
Merged

Add minimum token permissions for all github workflow files #990

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .github/workflows/base-ci-goreleaser.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,9 @@ on:
required: false
type: string

permissions:
contents: read

env:
# renovate: datasource=github-tags depName=goreleaser-pro packageName=goreleaser/goreleaser-pro
GORELEASER_PRO_VERSION: v2.7.0
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/base-package-tests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,9 @@ on:
default: false
description: "Set to true if a GH issue should be generated upon failure"

permissions:
contents: read

jobs:
package-tests:
name: Package Tests
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/base-release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,9 @@ on:
type: string
default: ubuntu-24.04

permissions:
contents: read

env:
# renovate: datasource=github-tags depName=goreleaser-pro packageName=goreleaser/goreleaser-pro
GORELEASER_PRO_VERSION: v2.7.0
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/builder-release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ on:
tags:
- "v*"

permissions:
contents: read

env:
# renovate: datasource=github-tags depName=goreleaser-pro packageName=goreleaser/goreleaser-pro
GORELEASER_PRO_VERSION: v2.7.0
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/builder-testbuild.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,9 @@ on:
- "go.mod"
- "go.sum"

permissions:
contents: read

env:
# renovate: datasource=github-tags depName=goreleaser-pro packageName=goreleaser/goreleaser-pro
GORELEASER_PRO_VERSION: v2.7.0
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,9 @@ on:
branches:
- main

permissions:
contents: read

env:
# Make sure to exit early if cache segment download times out after 2 minutes.
# We limit cache download as a whole to 5 minutes.
Expand Down
12 changes: 12 additions & 0 deletions .github/workflows/ci-goreleaser-contrib.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,10 @@ on:
- "go.mod"
- "go.sum"


permissions:
contents: read

jobs:
check-goreleaser:
name: CI - Contrib - GoReleaser
Expand All @@ -33,6 +37,10 @@ jobs:
goarch: '[ "386", "amd64", "arm64", "ppc64le", "arm", "s390x" ]'
secrets: inherit


permissions:
contents: read
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Doesn't this completely break the indentation?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah this looks completely wrong 🙈


package-tests:
name: Package tests
needs: check-goreleaser
Expand All @@ -41,6 +49,10 @@ jobs:
distribution: otelcol-contrib
type: '[ "deb", "rpm" ]'


permissions:
contents: read

msi-tests:
name: MSI tests
needs: check-goreleaser
Expand Down
12 changes: 12 additions & 0 deletions .github/workflows/ci-goreleaser-core.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,10 @@ on:
- "go.mod"
- "go.sum"


permissions:
contents: read

jobs:
check-goreleaser:
name: CI - Core - GoReleaser
Expand All @@ -33,6 +37,10 @@ jobs:
goarch: '[ "386", "amd64", "arm64", "ppc64le", "arm", "s390x" ]'
secrets: inherit


permissions:
contents: read

package-tests:
name: Package tests
needs: check-goreleaser
Expand All @@ -41,6 +49,10 @@ jobs:
distribution: otelcol
type: '[ "deb", "rpm" ]'


permissions:
contents: read

msi-tests:
name: MSI tests
needs: check-goreleaser
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/ci-goreleaser-ebpf-profiler.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,10 @@ on:
- "go.mod"
- "go.sum"


permissions:
contents: read

jobs:
check-goreleaser:
name: CI - eBPF Profiler - GoReleaser
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/ci-goreleaser-k8s.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,10 @@ on:
- "go.mod"
- "go.sum"


permissions:
contents: read

jobs:
check-goreleaser:
name: CI - k8s - GoReleaser
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/ci-goreleaser-otlp.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,10 @@ on:
- "go.mod"
- "go.sum"


permissions:
contents: read

jobs:
check-goreleaser:
name: CI - OTLP - GoReleaser
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,9 @@ on:
pull_request:
branches: [main]

permissions:
contents: read

jobs:
build:
name: Build
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/msi-tests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,9 @@ on:
required: true
type: string

permissions:
contents: read

jobs:
msi-tests:
name: MSI Tests
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/opampsupervisor-release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ on:
tags:
- "v*"

permissions:
contents: read

env:
# renovate: datasource=github-tags depName=goreleaser-pro packageName=goreleaser/goreleaser-pro
GORELEASER_PRO_VERSION: v2.7.0
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/opampsupervisor-testbuild.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,9 @@ on:
- "go.mod"
- "go.sum"

permissions:
contents: read

env:
# renovate: datasource=github-tags depName=goreleaser-pro packageName=goreleaser/goreleaser-pro
GORELEASER_PRO_VERSION: v2.7.0
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/package-test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ on:
schedule:
- cron: "0 2 * * *" # every day at 2am UTC

permissions:
contents: read

jobs:
check-goreleaser:
name: Build - Contrib - GoReleaser
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/release-contrib.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ on:
push:
tags: ["v*"]

permissions:
contents: read

jobs:
release:
name: Release Contrib
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/release-core.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ on:
push:
tags: ["v*"]

permissions:
contents: read

jobs:
release:
name: Release Core
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/release-k8s.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ on:
push:
tags: ["v*"]

permissions:
contents: read

jobs:
release:
name: Release k8s
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/release-otlp.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ on:
push:
tags: ["v*"]

permissions:
contents: read

jobs:
release:
name: Release OTLP
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/shellcheck.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,9 @@ on:
pull_request:
branches: [ main ]

permissions:
contents: read

jobs:
shellcheck:
name: Shellcheck
Expand Down
6 changes: 6 additions & 0 deletions .github/workflows/stale.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,14 @@ on:
schedule:
- cron: "12 5 * * *" # arbitrary time not to DDOS GitHub

permissions:
contents: read

jobs:
stale:
permissions:
issues: write # required for managing stale issues
pull-requests: write # required for managing stale PRs
runs-on: ubuntu-24.04
env:
GH_TOKEN: ${{ github.token }}
Expand Down
6 changes: 6 additions & 0 deletions .github/workflows/update-version.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,14 @@ on:
required: false
default: ''

permissions:
contents: read

jobs:
update-version:
permissions:
contents: write # required for pushing changes
pull-requests: write # required for creating PRs
runs-on: ubuntu-24.04
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Expand Down
Loading