From 59e3c2cb4556da9a213096b218cfb9b2bbae1d18 Mon Sep 17 00:00:00 2001 From: Arpit Jain Date: Tue, 26 May 2026 15:31:33 +0900 Subject: [PATCH 1/2] ci: declare workflow-level contents: read on 7 CI workflows All 7 workflows (checkDependencies, ci, codeql, doCleanCode, pr-checks, unit-tests, version-increments) just run checks and validation. No GitHub API writes from the workflows themselves at the workflow level. For workflows where individual jobs need a higher scope (e.g., codeql analyze typically needs security-events: write), job-level permissions can still override upward. This PR only adds the workflow-level cap. Same post-CVE-2025-30066 (tj-actions/changed-files) hardening pattern. yaml.safe_load validated on each touched file. Signed-off-by: Arpit Jain --- .github/workflows/checkDependencies.yml | 3 +++ .github/workflows/ci.yml | 3 +++ .github/workflows/codeql.yml | 3 +++ .github/workflows/doCleanCode.yml | 3 +++ .github/workflows/pr-checks.yml | 3 +++ .github/workflows/unit-tests.yml | 3 +++ .github/workflows/version-increments.yml | 3 +++ 7 files changed, 21 insertions(+) diff --git a/.github/workflows/checkDependencies.yml b/.github/workflows/checkDependencies.yml index 40425788ba1..005ee4a16e6 100644 --- a/.github/workflows/checkDependencies.yml +++ b/.github/workflows/checkDependencies.yml @@ -7,6 +7,9 @@ on: schedule: - cron: '0 0 * * *' +permissions: + contents: read + jobs: check-dependencies: uses: eclipse-platform/eclipse.platform.releng.aggregator/.github/workflows/checkDependencies.yml@master diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fde222c38eb..884cbf53ea5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -15,6 +15,9 @@ on: - 'docs/**' - '*.md' +permissions: + contents: read + jobs: build: uses: eclipse-platform/eclipse.platform.releng.aggregator/.github/workflows/mavenBuild.yml@master diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 46f3230490a..cc669cadbcb 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -8,6 +8,9 @@ on: schedule: - cron: '15 8 * * 1' +permissions: + contents: read + jobs: callCodeQLworkflow: uses: eclipse-platform/eclipse.platform.releng.aggregator/.github/workflows/codeQLworkflow.yml@master diff --git a/.github/workflows/doCleanCode.yml b/.github/workflows/doCleanCode.yml index 2242d3adba8..a976c24d7db 100644 --- a/.github/workflows/doCleanCode.yml +++ b/.github/workflows/doCleanCode.yml @@ -7,6 +7,9 @@ on: schedule: - cron: '0 2 * * *' +permissions: + contents: read + jobs: clean-code: uses: eclipse-platform/eclipse.platform.releng.aggregator/.github/workflows/cleanCode.yml@master diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index d8dfc50969a..61e4a4b4792 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -9,6 +9,9 @@ on: pull_request: branches: [ master ] +permissions: + contents: read + jobs: check-freeze-period: uses: eclipse-platform/eclipse.platform.releng.aggregator/.github/workflows/verifyFreezePeriod.yml@master diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml index 32759a5869b..f5650319d91 100644 --- a/.github/workflows/unit-tests.yml +++ b/.github/workflows/unit-tests.yml @@ -6,6 +6,9 @@ on: types: - completed +permissions: + contents: read + jobs: check: uses: eclipse-platform/eclipse.platform.releng.aggregator/.github/workflows/publishTestResults.yml@master diff --git a/.github/workflows/version-increments.yml b/.github/workflows/version-increments.yml index 7f0450b41ac..c4d9915aefb 100644 --- a/.github/workflows/version-increments.yml +++ b/.github/workflows/version-increments.yml @@ -5,6 +5,9 @@ on: workflows: [ 'Pull-Request Checks' ] types: [ completed ] +permissions: + contents: read + jobs: publish-version-check-results: uses: eclipse-platform/eclipse.platform.releng.aggregator/.github/workflows/publishVersionCheckResults.yml@master From d0c8144d6132f646f785e0be5c93e99e2d2311b8 Mon Sep 17 00:00:00 2001 From: Arpit Jain Date: Fri, 5 Jun 2026 21:14:49 +0900 Subject: [PATCH 2/2] ci: drop workflow-perms cap on reusable-workflow callers codeql.yml, pr-checks.yml and unit-tests.yml only call reusable workflows. A caller's workflow-level permissions cap the GITHUB_TOKEN for the called workflow, which cannot request more than the caller grants. The contents: read block here was stripping scopes the callees need: - codeQLworkflow.yml needs security-events: write and actions: read to upload CodeQL results to Code Scanning (the issue @akurtakov asked to correct) - verifyFreezePeriod.yml needs issues: read - checkMergeCommits.yml needs pull-requests: read - publishTestResults.yml needs checks: write, pull-requests: write, issues: read and actions: read Revert the permissions block on these three reusable-only callers; each reusable workflow already declares its own least-privilege permissions. The contents: read additions on the remaining workflows in this PR are kept. Signed-off-by: Arpit Jain --- .github/workflows/codeql.yml | 3 --- .github/workflows/pr-checks.yml | 3 --- .github/workflows/unit-tests.yml | 3 --- 3 files changed, 9 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index cc669cadbcb..46f3230490a 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -8,9 +8,6 @@ on: schedule: - cron: '15 8 * * 1' -permissions: - contents: read - jobs: callCodeQLworkflow: uses: eclipse-platform/eclipse.platform.releng.aggregator/.github/workflows/codeQLworkflow.yml@master diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index 61e4a4b4792..d8dfc50969a 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -9,9 +9,6 @@ on: pull_request: branches: [ master ] -permissions: - contents: read - jobs: check-freeze-period: uses: eclipse-platform/eclipse.platform.releng.aggregator/.github/workflows/verifyFreezePeriod.yml@master diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml index f5650319d91..32759a5869b 100644 --- a/.github/workflows/unit-tests.yml +++ b/.github/workflows/unit-tests.yml @@ -6,9 +6,6 @@ on: types: - completed -permissions: - contents: read - jobs: check: uses: eclipse-platform/eclipse.platform.releng.aggregator/.github/workflows/publishTestResults.yml@master