fix: add least-privilege GITHUB_TOKEN permissions to workflows#3080
fix: add least-privilege GITHUB_TOKEN permissions to workflows#3080sammdec wants to merge 3 commits into
Conversation
Resolves the 28 `actions/missing-workflow-permissions` code-scanning alerts. Every workflow now declares an explicit top-level permissions block (default `contents: read`), with individual jobs elevated only to what they actually need: - next_js_analyze / prepare_jobs / deploy_fork: pull-requests: write (post PR comments); +actions: read where they pull artifacts from the triggering run (workflow_run). - notify_success / notify_failure: pull-requests: write + issues: write (update comment + add/remove CI label). - prepare_release[_no_cypress] + update-prod-staging: contents: write (create the GitHub release). - crowdin upload/download authenticate via BOT_TOKEN, so GITHUB_TOKEN stays read-only. No behavioural change to any job's steps. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Mjolnir Security ReviewNew commits since last review at 3 PRs reviewed |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
📦 Next.js Bundle Analysis for aave-uiThis analysis was generated by the Next.js Bundle Analysis action. 🤖 🎉 Global Bundle Size Decreased
DetailsThe global bundle is the javascript bundle that loads alongside every page. It is in its own category because its impact is much higher - an increase to its size means that every page on your website loads slower, and a decrease means every page loads faster. Any third party scripts you have added directly to your app using the If you want further insight into what is behind the changes, give @next/bundle-analyzer a try! |
The aave/pinata-action leaves a deployment comment using github.token: issues.createComment on pull_request events, repos.createCommitComment otherwise. The default contents:read broke the deploy jobs. - build-test-deploy-dev deploy (pull_request): + pull-requests: write - build-test-deploy deploy (push): contents: write (commit comment) - test-deploy-fork deploy_fork (workflow_run): contents: read -> write (commit-comment branch), keeping actions: read + pull-requests: write Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
📦 Next.js Bundle Analysis for aave-uiThis analysis was generated by the Next.js Bundle Analysis action. 🤖
|
| Page | Size (compressed) |
|---|---|
global |
1.32 MB (🟡 +1 B) |
Details
The global bundle is the javascript bundle that loads alongside every page. It is in its own category because its impact is much higher - an increase to its size means that every page on your website loads slower, and a decrease means every page loads faster.
Any third party scripts you have added directly to your app using the <script> tag are not accounted for in this analysis
If you want further insight into what is behind the changes, give @next/bundle-analyzer a try!
build-test-deploy.yml only runs on push to main, where
github.event.pull_request.number is empty, so these
secrets[format('FORK_..._{0}', ...)] lookups resolved to empty
non-existent secret names and did nothing. Removing them clears three
actions/excessive-secrets-exposure alerts (the dynamic indexing forced
the whole secrets context onto the runner) with no behavioural change.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
📦 Next.js Bundle Analysis for aave-uiThis analysis was generated by the Next.js Bundle Analysis action. 🤖 🎉 Global Bundle Size Decreased
DetailsThe global bundle is the javascript bundle that loads alongside every page. It is in its own category because its impact is much higher - an increase to its size means that every page on your website loads slower, and a decrease means every page loads faster. Any third party scripts you have added directly to your app using the If you want further insight into what is behind the changes, give @next/bundle-analyzer a try! |
2 participants
Summary
Resolves the 28
actions/missing-workflow-permissionscode-scanning alerts (including #44). None of the workflows declared an explicitpermissionsblock, so every job ran with the broad defaultGITHUB_TOKEN.Each workflow now sets a least-privilege top-level default (
contents: read), and individual jobs are elevated only to what they actually use:contents: readBOT_TOKENnext_js_analyzepull-requests: writenext_js_analyzepull-requests: writeprepare_release,prepare_release_no_cypresscontents: writedeploycontents: writeprepare_jobs,next_js_analyze,deploy_forkactions: read+pull-requests: writenotify_success,notify_failurepull-requests: write+issues: writeNotes
dependency-review.ymlalready declared permissions and wasn't flagged; left untouched.Test plan
🤖 Generated with Claude Code