Add explicit permissions to linting, unit test, and doc link workflows#5075
Open
qubeena07 wants to merge 7 commits into
Open
Add explicit permissions to linting, unit test, and doc link workflows#5075qubeena07 wants to merge 7 commits into
qubeena07 wants to merge 7 commits into
Conversation
Co-authored-by: ZenML GmbH <info@zenml.io> (cherry picked from commit 2de41ef)
* Updated docs to include K8s distros * Adjusted for accuracy and clarity * Also added to pro section
These reusable and entry point workflows relied on the default GITHUB_TOKEN permissions, which grant broader access than they need. Each now declares an empty workflow level permissions block and scopes each job to only what it actually uses (contents read for checkout, pull requests write only where a PR comment is posted). Checkout steps that do not push commits now also set persist credentials to false. First batch toward auditing all workflows for zenml-io#4658
The pr labeler workflow had no permissions block, so it lost its default write access once the repo tightened token permissions as part of the ongoing actions audit, causing every PR to fail with Resource not accessible by integration when the labeler tried to add labels. Also the unpinned uses ignore entries in zizmor.yml still pointed at old line numbers for update-templates-to-examples.yml, so the file drifted out of sync after edits and zizmor started flagging the intentionally unpinned template actions as real findings, blocking CI.
The template-injection ignore entries for release.yml also pointed at old line numbers, 169 and 170, while the actual findings are now at 162 and 163 after earlier edits to the file. Same class of drift as the update-templates-to-examples.yml entries fixed previously. Verified zizmor now exits clean, 0, against the full workflow set.
GitHub always issues a read only GITHUB_TOKEN for pull_request events triggered from a forked repository, regardless of any permissions block declared in the workflow. The pr labeler job and the check links comment steps were still attempting those writes on fork PRs and dying with Resource not accessible by integration. Both now check that the PR head repo matches the base repo before running, so fork PRs skip the write attempt cleanly instead of failing the whole check. Same origin repo PRs are unaffected.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
First batch of the workflow permissions audit tracked in #4658.
These five workflows relied on the default GITHUB_TOKEN permissions, which are broader than they need:
Each now declares an empty workflow level permissions block and grants only what each job actually uses, following the same pattern already used in dependency audit.yml and zizmor.yml. Most jobs only need contents read for checkout. The jobs that post a PR comment (post summary in check links.yml and check links in check markdown links.yml) get pull requests write instead. Checkout steps that do not push commits now also set persist credentials to false.
More workflows remain to audit, this covers the CI linting and doc link checking group as a first incremental step per the issue's own guidance to address this incrementally across multiple PRs.
Test plan