From 16df438dbd60995764cd567d0b8d7d10fe9630ff Mon Sep 17 00:00:00 2001 From: Oleksandr Lystopad Date: Wed, 22 Jul 2026 15:20:58 +0200 Subject: [PATCH] .github: scope actions: write to merge-queue self-cancel jobs These CI test workflows self-cancel the CI Gate run on first merge-queue failure via `gh run cancel`, which needs actions: write. Add explicit least-privilege permissions instead of relying on the broad default token: - Single-job workflows (check-large-files, lint, reproducible-build, test-all-erigon, test-bench, sonar): top-level contents: read + actions: write. - Multi-job workflows (test-all-erigon-race, test-eest-spec, test-integration-caplin): top-level contents: read, with actions: write scoped to only the jobs that run the cancel step. sonar also reads the Actions API (gh api runs/artifacts, download-artifact, covered by actions: write) and gets pull-requests: read for SonarCloud PR analysis context. Part of the #21132 excessive-permissions cleanup. --- .github/workflows/check-large-files.yml | 4 ++++ .github/workflows/lint.yml | 4 ++++ .github/workflows/reproducible-build.yml | 4 ++++ .github/workflows/sonar.yml | 5 +++++ .github/workflows/test-all-erigon-race.yml | 9 +++++++++ .github/workflows/test-all-erigon.yml | 4 ++++ .github/workflows/test-bench.yml | 4 ++++ .github/workflows/test-eest-spec.yml | 9 +++++++++ .github/workflows/test-integration-caplin.yml | 9 +++++++++ 9 files changed, 52 insertions(+) diff --git a/.github/workflows/check-large-files.yml b/.github/workflows/check-large-files.yml index 5460ab417ff..a938cc60ee3 100644 --- a/.github/workflows/check-large-files.yml +++ b/.github/workflows/check-large-files.yml @@ -8,6 +8,10 @@ defaults: run: shell: bash +permissions: + contents: read + actions: write + jobs: check: runs-on: ubuntu-24.04 diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index d17fde729d8..4397c913bec 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -7,6 +7,10 @@ defaults: run: shell: bash +permissions: + contents: read + actions: write + jobs: lint: runs-on: ubuntu-latest diff --git a/.github/workflows/reproducible-build.yml b/.github/workflows/reproducible-build.yml index c203ba5781c..3a30df7d626 100644 --- a/.github/workflows/reproducible-build.yml +++ b/.github/workflows/reproducible-build.yml @@ -8,6 +8,10 @@ defaults: run: shell: bash +permissions: + contents: read + actions: write + jobs: reproducible-build: strategy: diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml index 86545ccdca1..290b759bb70 100644 --- a/.github/workflows/sonar.yml +++ b/.github/workflows/sonar.yml @@ -17,6 +17,11 @@ defaults: run: shell: bash +permissions: + contents: read + actions: write + pull-requests: read + jobs: sonar: runs-on: ubuntu-24.04 diff --git a/.github/workflows/test-all-erigon-race.yml b/.github/workflows/test-all-erigon-race.yml index fb2dc147a6d..fd2e5db512e 100644 --- a/.github/workflows/test-all-erigon-race.yml +++ b/.github/workflows/test-all-erigon-race.yml @@ -8,12 +8,18 @@ defaults: run: shell: bash +permissions: + contents: read + jobs: # Workflow files can't read local files directly — they must be loaded via a # job step. We do this so the matrix group names come from the same source as # the test code (tools/test-groups), keeping CI and local runs in sync. load-matrix: runs-on: ubuntu-latest + permissions: + contents: read + actions: write timeout-minutes: 60 outputs: test-groups: ${{ steps.load.outputs.groups }} @@ -57,6 +63,9 @@ jobs: - parallel name: tests-linux (${{ matrix.os }}, ${{ matrix.test-group }}, ${{ matrix.exec_mode }}) runs-on: ${{ matrix.os }} + permissions: + contents: read + actions: write steps: - name: Declare runners diff --git a/.github/workflows/test-all-erigon.yml b/.github/workflows/test-all-erigon.yml index bc23d0b157e..beee47e6cb5 100644 --- a/.github/workflows/test-all-erigon.yml +++ b/.github/workflows/test-all-erigon.yml @@ -8,6 +8,10 @@ defaults: run: shell: bash +permissions: + contents: read + actions: write + jobs: tests-mac-linux: strategy: diff --git a/.github/workflows/test-bench.yml b/.github/workflows/test-bench.yml index ca14d8e42c4..f8ae811efc1 100644 --- a/.github/workflows/test-bench.yml +++ b/.github/workflows/test-bench.yml @@ -20,6 +20,10 @@ defaults: run: shell: bash +permissions: + contents: read + actions: write + jobs: benchmarks: name: benchmarks (${{ matrix.exec_mode }}) diff --git a/.github/workflows/test-eest-spec.yml b/.github/workflows/test-eest-spec.yml index 9afe9990871..eb2f5581736 100644 --- a/.github/workflows/test-eest-spec.yml +++ b/.github/workflows/test-eest-spec.yml @@ -13,6 +13,9 @@ defaults: run: shell: bash +permissions: + contents: read + jobs: # Matrix entries (shard / workers / max-allowed-failures) come from # tools/eest-spec-shards.yml so this workflow and tools/run-eest-spec-test.sh @@ -53,6 +56,9 @@ jobs: matrix: include: ${{ fromJson(needs.load-matrix.outputs.matrix) }} runs-on: ubuntu-24.04 + permissions: + contents: read + actions: write timeout-minutes: 60 env: RAMDISK_SIZE_MB: '8192' @@ -139,6 +145,9 @@ jobs: if: ${{ !inputs.cache-warming-only }} name: eest-shard-coverage runs-on: ubuntu-24.04 + permissions: + contents: read + actions: write timeout-minutes: 15 steps: - uses: actions/checkout@v7 diff --git a/.github/workflows/test-integration-caplin.yml b/.github/workflows/test-integration-caplin.yml index e3ee7559872..0f4b7aa0f3a 100644 --- a/.github/workflows/test-integration-caplin.yml +++ b/.github/workflows/test-integration-caplin.yml @@ -7,6 +7,9 @@ defaults: run: shell: bash +permissions: + contents: read + jobs: tests: strategy: @@ -14,6 +17,9 @@ jobs: # disable macos-15 until https://github.com/erigontech/erigon/issues/8789 os: [ ubuntu-24.04 ] # required check includes runner version. Do not change it only here. runs-on: ${{ matrix.os }} + permissions: + contents: read + actions: write timeout-minutes: 60 steps: @@ -66,6 +72,9 @@ jobs: matrix: os: [ windows-2025 ] runs-on: ${{ matrix.os }} + permissions: + contents: read + actions: write timeout-minutes: 60 steps: