Repository navigation
🏗️🔧：stop the workflows from keeping the token - #1889
Merged
Merged
Conversation
Ported from OpenINF/.github, where this is part of bccd6d2. lint-and-test.yml named no permissions at all, so it inherited whatever the repository hands a workflow by default -- which for a repository that has not been narrowed is a write token, held for the length of an install and a lint run. Naming any permission drops the rest to none, so `contents: read` plus the `pull-requests: read` that paths-filter needs is the whole of what this workflow does. The filter stays. The reasoning that retired it in OpenINF/.github does not hold here: that suite reads files, while this one builds a site and starts a JVM, so what filtering buys there and here is not the same number. Separately, actions/checkout leaves its token in .git/config unless told not to. Nothing downstream of any of these four checkouts pushes, and no dependency is git-hosted, so the token is only sitting where `pnpm install` and everything after it could reach it. Wider than the change it is ported from, and deliberately so: the upstream repository has two of these workflows and this one has four. deploy.yml uploads an artifact and lets deploy-pages authenticate with its own id-token, and vendored-sync.yml talks to the API through GH_TOKEN rather than through git, so neither needs the credential either. Hardening two of four and leaving the other two would be harder to explain than doing all of them. Signed-off-by: Derek Lewis <DerekNonGeneric@inf.is> Assisted-by: Claude-Code:claude-opus-5
✅ Deploy Preview for gh-pages-openinf ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (4)
Included review availability: Your plan provides up to 8 included reviews per hour; 5 remain after this review. 📝 WalkthroughWalkthroughThe workflows now restrict permissions and disable persisted Git credentials during checkout. Deployment continues to use the Pages action identity token. ChangesWorkflow security hardening
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to Workflow credentials are reduced and no longer retained in Git configuration; deployment and vendored-sync authentication paths remain supported. No merge-blocking risk is identified. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
DerekNonGeneric
added
the
🚀 Status: Commit Queue
openinf-commit-queue
Bot
removed
the
🚀 Status: Commit Queue
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ported from
OpenINF/.github, where this is part ofbccd6d2.lint-and-test.ymlnamed no permissions at all, so it inherited whatever the repository hands a workflow by default — for a repository that has not been narrowed, a write token, held for the length of an install and a lint run. Naming any permission drops the rest to none, socontents: readplus thepull-requests: readthat paths-filter needs is the whole of what this workflow does.Separately,
actions/checkoutleaves its token in.git/configunless told not to. Nothing downstream of any of these checkouts pushes, and no dependency is git-hosted, so the token is only sitting wherepnpm installand everything after it could reach it.The filter stays
OpenINF/.githubretired its paths filter in the same series of changes. That reasoning does not transfer: its suite reads files, while this one builds a site and starts a JVM, so what filtering buys there and here is not the same number. Only the permissions and the checkout credential move across.Wider than the change it is ported from
Deliberately, and worth a look. The upstream repository has two of these workflows; this one has four.
deploy.ymluploads an artifact and letsdeploy-pagesauthenticate with its ownid-token.vendored-sync.ymltalks to the API throughGH_TOKENrather than through git.Neither needs the git credential either, and neither runs a
gitcommand that would want it. Hardening two of four and leaving the other two would be harder to explain than doing all of them — but if you would rather this stayed a literal port, the last two files are easy to drop.How it was checked
verify.yamlandverify.spellingpass; no new failures acrossverify.all.Summary by CodeRabbit