From 4ab1a9e6bdc7b1a6bccc83c52ed176914c33b3d9 Mon Sep 17 00:00:00 2001 From: Marian Steinbach Date: Fri, 23 Jan 2026 15:28:31 +0100 Subject: [PATCH 1/3] Remove default permissions for GITHUB_TOKEN --- .github/workflows/create-release-pr.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/create-release-pr.yaml b/.github/workflows/create-release-pr.yaml index e49d9e2..340a637 100644 --- a/.github/workflows/create-release-pr.yaml +++ b/.github/workflows/create-release-pr.yaml @@ -12,6 +12,8 @@ on: description: "Token to create the pull request" required: true +permissions: {} + jobs: debug_info: name: Debug info From c66d1a93872c9985a4d6b93d65f27d21e290b2c8 Mon Sep 17 00:00:00 2001 From: Marian Steinbach Date: Fri, 23 Jan 2026 15:28:40 +0100 Subject: [PATCH 2/3] Set job level permissions --- .github/workflows/create-release-pr.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/create-release-pr.yaml b/.github/workflows/create-release-pr.yaml index 340a637..0bcfc78 100644 --- a/.github/workflows/create-release-pr.yaml +++ b/.github/workflows/create-release-pr.yaml @@ -126,6 +126,8 @@ jobs: prepare_release_pr: name: Prepare release PR for Backstage project runs-on: ubuntu-24.04 + permissions: + contents: read needs: - gather_facts if: ${{ needs.gather_facts.outputs.skip != 'true' && github.repository == 'giantswarm/backstage' }} @@ -163,6 +165,8 @@ jobs: create_release_pr: name: Create release PR runs-on: ubuntu-24.04 + permissions: + contents: read needs: - gather_facts - prepare_release_pr From 386b746e52e2414b16c4984ed42262dde471ebe8 Mon Sep 17 00:00:00 2001 From: Marian Steinbach Date: Fri, 23 Jan 2026 15:51:28 +0100 Subject: [PATCH 3/3] Update CHANGELOG.md --- CHANGELOG.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 37d3ca2..a8f55ab 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), however this project does not use Semantic Versioning and there are no releases. Instead this file uses a date-based structure. +## 2026-01-23 + +### Changed + +- Restrict permissions for GITHUB_TOKEN in "Create Release PR" workflow. + ## 2026-01-16 ### Changed