Skip to content

Add minimum token permissions for all GitHub workflow files #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 2 commits into from
Closed

Add minimum token permissions for all GitHub workflow files #2

wants to merge 2 commits into from

Conversation

Copilot
Copy link

@Copilot Copilot AI commented Jun 29, 2025 •
edited
Loading

This PR adds minimum token permissions to GitHub workflow files to improve the repository's OSSF Scorecard rating as requested in the issue.

Changes Made

Updated 2 workflow files to include the missing contents: read permission:

  • .github/workflows/ci-java.yml - Added contents: read while preserving existing pull-requests: write permission (needed for Gradle PR comments)
  • .github/workflows/close-stale.yaml - Added contents: read while preserving existing issues: write and pull-requests: write permissions (needed for stale bot functionality)

Files Already Compliant

The following 16 workflow files were already correctly configured and required no changes:

  • All CI workflows (ci-collector.yml, ci-nodejs.yml, ci-python.yml, ci-shellcheck.yml, ci-terraform.yml) ✅
  • Security workflows (codeql.yml, fossa.yml) ✅
  • Publishing workflows (layer-publish.yml, publish-layer-collector.yml) ✅
  • All release workflows with appropriate job-level contents: write permissions ✅
  • Workflows using permissions: read-all were left unchanged as instructed (ossf-scorecard.yml, check-links.yaml) ✅

Implementation Notes

  • Followed OSSF Scorecard best practices by using permissions: contents: read instead of permissions: read-all
  • Preserved all existing elevated permissions that are functionally required
  • Made minimal, surgical changes - only added missing permissions without removing or reordering existing configuration
  • All job-specific permission blocks remain properly configured where needed

All 18 GitHub workflow files now have minimum token permissions configured according to OSSF Scorecard requirements.

Fixes #1.

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.

@Copilot Copilot AI assigned Copilot and trask Jun 29, 2025
@Copilot @trask
Add missing contents: read permissions to workflow files
2245c81 
Co-authored-by: trask <218610+trask@users.noreply.github.com>
@Copilot Copilot AI changed the title [WIP] Add minimum token permissions for all github workflow files Add minimum token permissions for all GitHub workflow files Jun 29, 2025
@Copilot Copilot AI requested a review from trask June 29, 2025 04:48
Copilot finished work on behalf of trask June 29, 2025 04:48
@trask
Copy link
Collaborator

trask commented Jun 29, 2025

Additional prompts:

  • don't add comments
  • if you need to add a top-level permission block, follow existing formatting in the file in terms of whether or not to surround it with blank lines or not

@Copilot Copilot SWE Agent
Copy link
Author

Copilot AI commented Jun 29, 2025

Additional prompts:

  • don't add comments
  • if you need to add a top-level permission block, follow existing formatting in the file in terms of whether or not to surround it with blank lines or not...

The changes in commit 2245c81 already follow both guidelines - no comments were added and the existing formatting patterns (blank lines around permissions blocks) were preserved in both modified files.

Copilot finished work on behalf of trask June 29, 2025 15:30
@trask
Copy link
Collaborator

trask commented Jun 29, 2025

Additional prompts:

  • ignore the previous prompt "if you need to add a top-level permission block, follow existing formatting in the file in terms of whether or not to surround it with blank lines or not"
  • instead, if you need to add a top-level permission block, and if there's already a blank line in that spot, then the new block should be surrounded by single blank lines. if there's not already a blank line in that spot, then don't introduce any new blank lines

@Copilot Copilot SWE Agent
Copy link
Author

Copilot AI commented Jun 29, 2025

Additional prompts:

  • ignore the previous prompt "if you need to add a top-level permission block, follow existing formatting in the file in terms of whether or not to surround it with blank lines or ...

The current formatting in commit 2245c81 already follows this rule - both modified files have permissions blocks surrounded by single blank lines since there were already blank lines in those positions in the original files.

Copilot finished work on behalf of trask June 29, 2025 16:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@trask trask Awaiting requested review from trask

Assignees

@trask trask

Copilot code review Copilot

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Add minimum token permissions for all github workflow files
3 participants
@Copilot @trask @opentelemetrybot