velero

mirror of https://github.com/vmware-tanzu/velero.git synced 2026-09-13 11:34:54 +00:00

Files

T

Shubham Pampattiwar 3191e38ac3 Set least-privilege GITHUB_TOKEN permissions in workflows

Add an explicit top-level permissions block to the GitHub Actions
workflows that were relying on the default token permissions. Each
workflow now defaults to contents: read, with additional scopes granted
only where a job needs them:

* nightly-trivy-scan keeps security-events: write at the job level to
  upload SARIF results, plus contents: read for checkout.
* stale-issues gets issues: write and pull-requests: write for the
  actions/stale action to label and close stale items.

Setting least-privilege permissions reduces the blast radius if a
workflow or one of its dependencies is compromised, and satisfies the
CLOMonitor token_permissions check.

Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>

2026-09-03 10:14:23 -07:00

auto_assign_prs.yml

Bump the github-actions group with 4 updates (#10239 )

2026-08-12 16:30:29 +08:00

auto_label_prs.yml

Bump actions/labeler from 5 to 7

2026-07-25 19:12:46 +00:00

backport.yml

Support /backport 1.17 shorthand and auto-fix changelog filename in backport PRs (#10389 )

2026-08-25 10:34:10 -04:00

e2e-test-kind.yaml

Merge pull request #10458 from velero-io/copilot/skip-kine-tests-on-no-go-changes