From 21f4e5d13881b370fc2e162e9ea7f198f67cab58 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lorenz=20H=C3=BCbschle?= Date: Wed, 7 Oct 2026 13:59:50 +0200 Subject: [PATCH 1/2] fix: restrict CI checkouts and cache access --- .github/workflows/code-check.yml | 10 ++++------ .github/workflows/security-scan.yml | 7 +------ .github/workflows/unit-tests.yml | 7 +------ 3 files changed, 6 insertions(+), 18 deletions(-) diff --git a/.github/workflows/code-check.yml b/.github/workflows/code-check.yml index 6409780d774..f2764066734 100644 --- a/.github/workflows/code-check.yml +++ b/.github/workflows/code-check.yml @@ -2,22 +2,20 @@ name: Code quality checks on: workflow_call: - inputs: - branch: - required: false - type: string - description: 'Branch to run on' push: branches: [ main, 0.x ] jobs: check-code: runs-on: ubuntu-latest + permissions: + contents: read + cache-mode: none steps: - name: Check out code uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: - ref: ${{ inputs.branch }} + persist-credentials: false - name: Set up Python 3.10 uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml index facb9507223..a1c0f519508 100644 --- a/.github/workflows/security-scan.yml +++ b/.github/workflows/security-scan.yml @@ -3,11 +3,6 @@ name: Firebolt Security Scan on: workflow_dispatch: workflow_call: - inputs: - branch: - required: false - type: string - description: 'Branch to run on' secrets: FOSSA_TOKEN: required: true @@ -21,7 +16,7 @@ jobs: - name: "Checkout Code" uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: - ref: ${{ inputs.branch }} + persist-credentials: false - name: "Download coverage report" uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml index 7267110eaa5..9e0683d58b7 100644 --- a/.github/workflows/unit-tests.yml +++ b/.github/workflows/unit-tests.yml @@ -5,11 +5,6 @@ name: Unit tests on: workflow_call: - inputs: - branch: - required: false - type: string - description: 'Branch to run on' secrets: GIST_PAT: required: true @@ -25,7 +20,7 @@ jobs: - name: Check out code uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: - ref: ${{ inputs.branch }} + persist-credentials: false - name: Set up Python 3.10 uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 From dbc12726eb2ba8bc84328580acab1e98daf64a39 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lorenz=20H=C3=BCbschle?= Date: Wed, 7 Oct 2026 14:01:07 +0200 Subject: [PATCH 2/2] fix: declare least-privilege workflow token permissions --- .github/workflows/build-documentation.yml | 3 +++ .github/workflows/check-pr-formatting.yml | 3 +++ .github/workflows/code-check.yml | 3 +++ .github/workflows/integration-tests-core.yml | 4 ++++ .github/workflows/integration-tests-v2.yml | 3 +++ .github/workflows/integration-tests.yml | 6 ++++++ .github/workflows/nightly-v2.yml | 7 +++++++ .github/workflows/pull-request.yml | 6 ++++++ .github/workflows/release.yml | 6 ++++++ .github/workflows/security-scan.yml | 4 ++++ .github/workflows/unit-tests.yml | 3 +++ 11 files changed, 48 insertions(+) diff --git a/.github/workflows/build-documentation.yml b/.github/workflows/build-documentation.yml index 6571f934962..38d4b457e40 100644 --- a/.github/workflows/build-documentation.yml +++ b/.github/workflows/build-documentation.yml @@ -11,6 +11,9 @@ on: types: - created +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest diff --git a/.github/workflows/check-pr-formatting.yml b/.github/workflows/check-pr-formatting.yml index 5bed55edf02..623989f425f 100644 --- a/.github/workflows/check-pr-formatting.yml +++ b/.github/workflows/check-pr-formatting.yml @@ -5,6 +5,9 @@ on: branches: [ main, 0.x ] types: [opened, synchronize, edited] +permissions: + contents: read + jobs: pr-formatting: runs-on: ubuntu-slim diff --git a/.github/workflows/code-check.yml b/.github/workflows/code-check.yml index f2764066734..91cca23e493 100644 --- a/.github/workflows/code-check.yml +++ b/.github/workflows/code-check.yml @@ -5,6 +5,9 @@ on: push: branches: [ main, 0.x ] +permissions: + contents: read + jobs: check-code: runs-on: ubuntu-latest diff --git a/.github/workflows/integration-tests-core.yml b/.github/workflows/integration-tests-core.yml index c3c9330ba46..af23184361d 100644 --- a/.github/workflows/integration-tests-core.yml +++ b/.github/workflows/integration-tests-core.yml @@ -41,6 +41,10 @@ on: secrets: SLACK_BOT_TOKEN: required: false + +permissions: + contents: read + jobs: run-core-integration-tests: permissions: diff --git a/.github/workflows/integration-tests-v2.yml b/.github/workflows/integration-tests-v2.yml index c29fad76b26..5001733d05c 100644 --- a/.github/workflows/integration-tests-v2.yml +++ b/.github/workflows/integration-tests-v2.yml @@ -14,6 +14,9 @@ on: type: string default: '' +permissions: + contents: read + jobs: tests: permissions: diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml index eb9760da9c3..99836e698b5 100644 --- a/.github/workflows/integration-tests.yml +++ b/.github/workflows/integration-tests.yml @@ -7,6 +7,10 @@ on: required: true FIREBOLT_CLIENT_SECRET_STG_NEW_IDN: required: true + +permissions: + contents: read + jobs: integration-test-v2: uses: ./.github/workflows/integration-tests-v2.yml @@ -16,6 +20,8 @@ jobs: integration-test-core: uses: ./.github/workflows/integration-tests-core.yml report-test-results: + permissions: + statuses: write needs: [integration-test-v2, integration-test-core] if: always() runs-on: ubuntu-latest diff --git a/.github/workflows/nightly-v2.yml b/.github/workflows/nightly-v2.yml index c290b690a6f..c1b4529d4b6 100644 --- a/.github/workflows/nightly-v2.yml +++ b/.github/workflows/nightly-v2.yml @@ -3,6 +3,10 @@ on: workflow_dispatch: schedule: - cron: '0 3 * * *' # 3 am UTC every day + +permissions: + contents: read + jobs: code-check: uses: ./.github/workflows/code-check.yml @@ -11,6 +15,9 @@ jobs: secrets: GIST_PAT: ${{ secrets.GIST_PAT }} security-scan: + permissions: + contents: read + pull-requests: read needs: [unit-tests] uses: ./.github/workflows/security-scan.yml secrets: diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml index 56180e4eb09..9019ce3ee77 100644 --- a/.github/workflows/pull-request.yml +++ b/.github/workflows/pull-request.yml @@ -4,6 +4,9 @@ on: pull_request: branches: [ main, 0.x ] +permissions: + contents: read + jobs: code-checkers: uses: ./.github/workflows/code-check.yml @@ -13,6 +16,9 @@ jobs: GIST_PAT: ${{ secrets.GIST_PAT }} security-scan: + permissions: + contents: read + pull-requests: read needs: [unit-tests] uses: ./.github/workflows/security-scan.yml secrets: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8a972d18f49..8f5f4021cba 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -10,8 +10,14 @@ on: required: false description: 'Trigger a major release (optional). Leave empty for regular release.' +permissions: + contents: read + jobs: integration-tests: + permissions: + contents: read + statuses: write uses: ./.github/workflows/integration-tests.yml secrets: FIREBOLT_CLIENT_ID_STG_NEW_IDN: ${{ secrets.FIREBOLT_CLIENT_ID_STG_NEW_IDN }} diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml index a1c0f519508..9e1b5a16eee 100644 --- a/.github/workflows/security-scan.yml +++ b/.github/workflows/security-scan.yml @@ -9,6 +9,10 @@ on: SONARCLOUD_TOKEN: required: true +permissions: + contents: read + pull-requests: read + jobs: security-scan: runs-on: ubuntu-latest diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml index 9e0683d58b7..797b3fd25a0 100644 --- a/.github/workflows/unit-tests.yml +++ b/.github/workflows/unit-tests.yml @@ -11,6 +11,9 @@ on: push: branches: [ main, 0.x ] +permissions: + contents: read + jobs: unit-tests: runs-on: ubuntu-latest