Skip to content

security: limit cask workflow permissions - #5

Merged
SarthakWade merged 1 commit into
mainfrom
security/least-privilege-workflow
Sep 10, 2026
Merged

security: limit cask workflow permissions#5
SarthakWade merged 1 commit into
mainfrom
security/least-privilege-workflow

Conversation

@SarthakWade

Copy link
Copy Markdown
Contributor

Summary

  • make read-only contents access the workflow default
  • grant write access only to the scheduled cask update job
  • prevent pull-request validation checkouts from persisting credentials
  • pin actions/checkout to its verified v7.0.1 commit

Validation

  • actionlint
  • bash -n scripts/update-cask.sh scripts/test-update-cask.sh
  • shellcheck scripts/update-cask.sh scripts/test-update-cask.sh
  • ./scripts/test-update-cask.sh

@SarthakWade
SarthakWade merged commit e6cbbf6 into main Sep 10, 2026
4 checks passed
@SarthakWade
SarthakWade deleted the security/least-privilege-workflow branch September 10, 2026 17:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant