chore: added permissions to workflows to least possible permission [SPA-3604][ACT-2077] #1390
Conversation
Ollie-H
requested review from
SofiaMargariti and
kizer-cf
and removed request for
a team
|
The latest updates on your projects. Learn more about Vercel for GitHub.
3 Skipped Deployments
|
Wiz Scan Summary
To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension. |
Ollie-H
changed the title
…r into chore/SPA-3604-explicit-github-token-permissions
Chaoste
left a comment
Chaoste
left a comment
There was a problem hiding this comment.
Thanks for looking into this. The permissions look correct to me
| permissions: | ||
| contents: write # Checkout with full history | ||
| id-token: write # OIDC token for authentication | ||
| actions: read # Restore cache |
There was a problem hiding this comment.
I was under the assumption that a workflow inherits its permission from its parent. Since this one only has "contents: read" permission, is it possible to allow these jobs here to get more permissions?
There was a problem hiding this comment.
As I understand it from the docs, the job elevates permissions relative to the workflow baseline, which wouldn’t normally be allowed. However, here it is allowed because it happens in the caller workflow (here /vercel.yaml), so it doesn’t increase permissions within the same workflow.
Purpose
More info on changes in doc: https://contentful.atlassian.net/wiki/spaces/SRT/blog/2025/12/01/6020300812/Securing+GitHub+actions+and+workflows+priority+for+public+repositories
Ticket: https://contentful.atlassian.net/browse/SPA-3604
https://contentful.atlassian.net/browse/ACT-2077