From 0105bc2314368326159c39a367a7559f00314eb6 Mon Sep 17 00:00:00 2001 From: Dmitry Verkhoturov Date: Sat, 21 Feb 2026 23:37:14 +0000 Subject: [PATCH] Drop GitHub token permissions on deploy jobs Deploy jobs only curl an external updater URL and need no GitHub API access. Without an explicit permissions block they inherit the workflow default, which may include contents:write, packages:write, etc. Setting permissions to {} limits the blast radius if a job is compromised. --- .github/workflows/ci-site.yml | 1 + .github/workflows/docker.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/.github/workflows/ci-site.yml b/.github/workflows/ci-site.yml index 89d12e07..9b9388e0 100644 --- a/.github/workflows/ci-site.yml +++ b/.github/workflows/ci-site.yml @@ -135,6 +135,7 @@ jobs: runs-on: ubuntu-latest needs: merge if: github.ref == 'refs/heads/master' || github.event_name == 'release' + permissions: {} # only calls an external URL via curl, no GitHub API access needed steps: - name: trigger deployment diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 4ccb6ba9..1f239c6a 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -206,6 +206,7 @@ jobs: runs-on: ubuntu-latest needs: merge if: github.event.workflow_run.head_branch == 'master' + permissions: {} # only calls an external URL via curl, no GitHub API access needed steps: - name: trigger deployment