From 19c25e2458180450e6c107ac588c1137124256fc Mon Sep 17 00:00:00 2001 From: Aris Konstantoulas Date: Fri, 24 Apr 2026 09:46:05 +0300 Subject: [PATCH] chore(vuln): scope workflow permissions to least privilege (SEC-167) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 🔒 Scanned for secrets using gitleaks 8.30.1 --- .github/workflows/check-pr-title.yml | 3 +++ .github/workflows/manage-github-issue-for-outdated-pods.yml | 6 ++++++ 2 files changed, 9 insertions(+) diff --git a/.github/workflows/check-pr-title.yml b/.github/workflows/check-pr-title.yml index 383afce..ed6950c 100644 --- a/.github/workflows/check-pr-title.yml +++ b/.github/workflows/check-pr-title.yml @@ -4,6 +4,9 @@ on: branches: ['master'] types: ['opened', 'reopened', 'edited', 'synchronize'] +permissions: + contents: read + jobs: check_pr_title: name: Check PR title diff --git a/.github/workflows/manage-github-issue-for-outdated-pods.yml b/.github/workflows/manage-github-issue-for-outdated-pods.yml index 90edc51..30c54a3 100644 --- a/.github/workflows/manage-github-issue-for-outdated-pods.yml +++ b/.github/workflows/manage-github-issue-for-outdated-pods.yml @@ -5,8 +5,14 @@ on: - cron: '0 0 * * 1' workflow_dispatch: +permissions: + contents: read + jobs: check-outdated-pods: + permissions: + contents: read + issues: write runs-on: macos-latest name: Check outdate pods and create issue if it doesn't exist steps: