From 4ac3b521f8db3bacd4d3e732a176e8f75d6d0529 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Mon, 6 Jul 2026 12:05:04 +0200 Subject: [PATCH 1/3] ci: add least-privilege permissions to GitHub Actions workflows Restrict default GITHUB_TOKEN scope per workflow. Write scopes granted only where jobs dispatch/cancel workflows, publish packages, or label issues/PRs. Refs: APPSEC-164 --- .github/workflows/backend-checks.yml | 3 +++ .github/workflows/cron-checks.yml | 3 +++ .github/workflows/record-snapshots.yml | 4 ++++ .github/workflows/release-merge.yml | 4 ++++ .github/workflows/release-publish.yml | 3 +++ .github/workflows/release-start.yml | 4 ++++ .github/workflows/sdk-performance-metrics.yml | 4 ++++ .github/workflows/sdk-size-metrics.yml | 4 ++++ .github/workflows/smoke-checks.yml | 4 ++++ .github/workflows/sonar.yml | 4 ++++ .github/workflows/testflight.yml | 4 ++++ .github/workflows/update-copyright.yml | 3 +++ 12 files changed, 44 insertions(+) diff --git a/.github/workflows/backend-checks.yml b/.github/workflows/backend-checks.yml index 71be1ae63dc..9e3d54a09e6 100644 --- a/.github/workflows/backend-checks.yml +++ b/.github/workflows/backend-checks.yml @@ -7,6 +7,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: + contents: read + env: HOMEBREW_NO_INSTALL_CLEANUP: 1 # Disable cleanup for homebrew, we don't need it on CI IOS_SIMULATOR_DEVICE: "iPhone 16 Pro (18.5)" diff --git a/.github/workflows/cron-checks.yml b/.github/workflows/cron-checks.yml index eb4083cbb11..2d3ab32863d 100644 --- a/.github/workflows/cron-checks.yml +++ b/.github/workflows/cron-checks.yml @@ -17,6 +17,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: + contents: read + env: HOMEBREW_NO_INSTALL_CLEANUP: 1 # Disable cleanup for homebrew, we don't need it on CI GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/record-snapshots.yml b/.github/workflows/record-snapshots.yml index c05f727ab6b..e585e7df158 100644 --- a/.github/workflows/record-snapshots.yml +++ b/.github/workflows/record-snapshots.yml @@ -3,6 +3,10 @@ name: Record Snapshots on: workflow_dispatch: +permissions: + contents: read + actions: write + jobs: record: name: Record diff --git a/.github/workflows/release-merge.yml b/.github/workflows/release-merge.yml index 01763637e78..cd7fff4485c 100644 --- a/.github/workflows/release-merge.yml +++ b/.github/workflows/release-merge.yml @@ -4,6 +4,10 @@ on: issue_comment: types: [created] +permissions: + contents: read + issues: read + workflow_dispatch: jobs: diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml index 8cb3bf1c508..8a44c25aea1 100644 --- a/.github/workflows/release-publish.yml +++ b/.github/workflows/release-publish.yml @@ -3,6 +3,9 @@ name: "Publish new release" on: workflow_dispatch: +permissions: + contents: read + jobs: release: name: Publish new release diff --git a/.github/workflows/release-start.yml b/.github/workflows/release-start.yml index 4bcf2881c36..d6ab936c8a8 100644 --- a/.github/workflows/release-start.yml +++ b/.github/workflows/release-start.yml @@ -8,6 +8,10 @@ on: type: string required: true +permissions: + contents: read + actions: write + jobs: test-release: name: Start new release diff --git a/.github/workflows/sdk-performance-metrics.yml b/.github/workflows/sdk-performance-metrics.yml index e937e804ada..deb2817899e 100644 --- a/.github/workflows/sdk-performance-metrics.yml +++ b/.github/workflows/sdk-performance-metrics.yml @@ -19,6 +19,10 @@ on: env: HOMEBREW_NO_INSTALL_CLEANUP: 1 # Disable cleanup for homebrew, we don't need it on CI +permissions: + contents: read + pull-requests: read + jobs: performance: name: Metrics diff --git a/.github/workflows/sdk-size-metrics.yml b/.github/workflows/sdk-size-metrics.yml index 63ee748216a..8b6fff7a1b8 100644 --- a/.github/workflows/sdk-size-metrics.yml +++ b/.github/workflows/sdk-size-metrics.yml @@ -16,6 +16,10 @@ on: env: HOMEBREW_NO_INSTALL_CLEANUP: 1 # Disable cleanup for homebrew, we don't need it on CI +permissions: + contents: read + pull-requests: read + jobs: sdk_size: name: Metrics diff --git a/.github/workflows/smoke-checks.yml b/.github/workflows/smoke-checks.yml index b0b10b51ec1..2739f945232 100644 --- a/.github/workflows/smoke-checks.yml +++ b/.github/workflows/smoke-checks.yml @@ -19,6 +19,10 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: + contents: read + pull-requests: read + env: HOMEBREW_NO_INSTALL_CLEANUP: 1 # Disable cleanup for homebrew, we don't need it on CI IOS_SIMULATOR_DEVICE: "iPhone 17 Pro (26.2)" diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml index 0259101331f..969a6401eeb 100644 --- a/.github/workflows/sonar.yml +++ b/.github/workflows/sonar.yml @@ -9,6 +9,10 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: + contents: read + pull-requests: read + env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/testflight.yml b/.github/workflows/testflight.yml index 6b74efb36a5..1d1a5bf6b10 100644 --- a/.github/workflows/testflight.yml +++ b/.github/workflows/testflight.yml @@ -22,6 +22,10 @@ on: env: HOMEBREW_NO_INSTALL_CLEANUP: 1 +permissions: + contents: read + pull-requests: read + jobs: deploy: runs-on: macos-15 diff --git a/.github/workflows/update-copyright.yml b/.github/workflows/update-copyright.yml index 3492886d73f..b12e201e7ff 100644 --- a/.github/workflows/update-copyright.yml +++ b/.github/workflows/update-copyright.yml @@ -10,6 +10,9 @@ on: env: HOMEBREW_NO_INSTALL_CLEANUP: 1 # Disable cleanup for homebrew, we don't need it on CI +permissions: + contents: read + jobs: copyright: name: Copyright From 7263f5828ec22b3c7b4cfe039592ec83005831cf Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Mon, 6 Jul 2026 12:06:46 +0200 Subject: [PATCH 2/3] ci: fix permissions block YAML indentation --- .github/workflows/record-snapshots.yml | 2 +- .github/workflows/release-merge.yml | 2 +- .github/workflows/release-start.yml | 2 +- .github/workflows/sdk-performance-metrics.yml | 2 +- .github/workflows/sdk-size-metrics.yml | 2 +- .github/workflows/smoke-checks.yml | 2 +- .github/workflows/sonar.yml | 2 +- .github/workflows/testflight.yml | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/record-snapshots.yml b/.github/workflows/record-snapshots.yml index e585e7df158..d43d6ea1d54 100644 --- a/.github/workflows/record-snapshots.yml +++ b/.github/workflows/record-snapshots.yml @@ -5,7 +5,7 @@ on: permissions: contents: read - actions: write + actions: write jobs: record: diff --git a/.github/workflows/release-merge.yml b/.github/workflows/release-merge.yml index cd7fff4485c..cc377640618 100644 --- a/.github/workflows/release-merge.yml +++ b/.github/workflows/release-merge.yml @@ -6,7 +6,7 @@ on: permissions: contents: read - issues: read + issues: read workflow_dispatch: diff --git a/.github/workflows/release-start.yml b/.github/workflows/release-start.yml index d6ab936c8a8..72b1b565132 100644 --- a/.github/workflows/release-start.yml +++ b/.github/workflows/release-start.yml @@ -10,7 +10,7 @@ on: permissions: contents: read - actions: write + actions: write jobs: test-release: diff --git a/.github/workflows/sdk-performance-metrics.yml b/.github/workflows/sdk-performance-metrics.yml index deb2817899e..f923f92e132 100644 --- a/.github/workflows/sdk-performance-metrics.yml +++ b/.github/workflows/sdk-performance-metrics.yml @@ -21,7 +21,7 @@ env: permissions: contents: read - pull-requests: read + pull-requests: read jobs: performance: diff --git a/.github/workflows/sdk-size-metrics.yml b/.github/workflows/sdk-size-metrics.yml index 8b6fff7a1b8..40850caefa3 100644 --- a/.github/workflows/sdk-size-metrics.yml +++ b/.github/workflows/sdk-size-metrics.yml @@ -18,7 +18,7 @@ env: permissions: contents: read - pull-requests: read + pull-requests: read jobs: sdk_size: diff --git a/.github/workflows/smoke-checks.yml b/.github/workflows/smoke-checks.yml index 2739f945232..b6132998d08 100644 --- a/.github/workflows/smoke-checks.yml +++ b/.github/workflows/smoke-checks.yml @@ -21,7 +21,7 @@ concurrency: permissions: contents: read - pull-requests: read + pull-requests: read env: HOMEBREW_NO_INSTALL_CLEANUP: 1 # Disable cleanup for homebrew, we don't need it on CI diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml index 969a6401eeb..62f3ce3a389 100644 --- a/.github/workflows/sonar.yml +++ b/.github/workflows/sonar.yml @@ -11,7 +11,7 @@ concurrency: permissions: contents: read - pull-requests: read + pull-requests: read env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/testflight.yml b/.github/workflows/testflight.yml index 1d1a5bf6b10..e11228290ef 100644 --- a/.github/workflows/testflight.yml +++ b/.github/workflows/testflight.yml @@ -24,7 +24,7 @@ env: permissions: contents: read - pull-requests: read + pull-requests: read jobs: deploy: From 78cf17d33e3a12147d3e4278ddb60364614b02a1 Mon Sep 17 00:00:00 2001 From: Peter Matkovski Date: Mon, 6 Jul 2026 17:02:04 +0200 Subject: [PATCH 3/3] fix(ci): address CodeRabbit review on workflow permissions Move workflow_dispatch back under on: in release-merge.yml and drop unnecessary actions: write from release-start.yml (gh workflow run uses DANGER_GITHUB_API_TOKEN). Co-authored-by: Cursor --- .github/workflows/release-merge.yml | 3 +-- .github/workflows/release-start.yml | 1 - 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/workflows/release-merge.yml b/.github/workflows/release-merge.yml index cc377640618..dfad6184675 100644 --- a/.github/workflows/release-merge.yml +++ b/.github/workflows/release-merge.yml @@ -3,13 +3,12 @@ name: "Merge release" on: issue_comment: types: [created] + workflow_dispatch: permissions: contents: read issues: read - workflow_dispatch: - jobs: merge-release-to-main: name: Merge release to main diff --git a/.github/workflows/release-start.yml b/.github/workflows/release-start.yml index 72b1b565132..9797fa18566 100644 --- a/.github/workflows/release-start.yml +++ b/.github/workflows/release-start.yml @@ -10,7 +10,6 @@ on: permissions: contents: read - actions: write jobs: test-release: