Repository navigation
Add contents read permission to all GitHub Actions workflows - #1076
Conversation
Following the pattern from PR #1074, add `permissions: contents: read` to all workflow jobs that only need read access. The release-winget workflow already has appropriate write permissions. https://claude.ai/code/session_01PH4HxLHfpWeSNSS1MvK6f9
There was a problem hiding this comment.
Pull request overview
This PR tightens GitHub Actions job token permissions by explicitly setting permissions: contents: read on CI jobs, aligning workflows with least-privilege guidance while still allowing actions/checkout to function.
Changes:
- Added
permissions: contents: readto CI jobs across Python, Node.js, CMake, Bazel, MSVC, MinGW, and dictionary-sort check workflows. - Standardized per-job permission declarations instead of relying on implicit defaults.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/python.yml | Adds contents: read to unit-test and test-pypi jobs. |
| .github/workflows/nodejs.yml | Adds contents: read to build-and-test job. |
| .github/workflows/msvc.yml | Adds contents: read to build-and-test job. |
| .github/workflows/mingw.yml | Adds contents: read to build job. |
| .github/workflows/cmake.yml | Adds contents: read to build-and-test job. |
| .github/workflows/check-dictionary-sorted.yml | Adds contents: read to sort-check job. |
| .github/workflows/bazel.yml | Adds contents: read to build-and-test job. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| permissions: | ||
| contents: read |
There was a problem hiding this comment.
The PR title/description say this adds permissions: contents: read to all workflows, but the repo also contains release workflows (e.g. release-pypi.yml already has contents: read, and release-winget.yml uses contents: write). Consider adjusting the PR title/description to clarify scope (e.g. “all CI workflows” or “all non-release jobs”) so it matches what’s actually changed.
Summary
This PR adds explicit
permissions: contents: readdeclarations to all GitHub Actions workflow jobs to follow the principle of least privilege and improve security posture.Key Changes
permissions: contents: readto the following workflow jobs:python.yml:unit-testandtest-pypijobsbazel.yml:build-and-testjobcheck-dictionary-sorted.yml:sort-checkjobcmake.yml:build-and-testjobmingw.yml:buildjobmsvc.yml:build-and-testjobnodejs.yml:build-and-testjobImplementation Details
Each job now explicitly declares that it requires read access to repository contents, which is necessary for the
actions/checkoutstep and other operations that read the repository. This follows GitHub's security best practice of using minimal required permissions rather than relying on default permissions.