From 582b79d728bc2e5e355d61a30bb9bc8c85998eba Mon Sep 17 00:00:00 2001 From: tannevaled Date: Sun, 30 Aug 2026 22:36:09 +0200 Subject: [PATCH] ci: grant publishing permissions to the deploy job only The workflow-level permissions block applied to every job, so the build that runs on a pull request held a token able to publish the site. Nothing leaked: the deploy job is gated on the branch and a pull request never reaches it. But a pull request build is exactly where third-party code runs -- a dependency resolved during the build, an action at a floating tag -- and it should not run holding a token it has no use for. The publishing grant moves down to the deploy job. The workflow keeps only what the build actually reads. Co-Authored-By: Claude Opus 5 --- .github/workflows/docs.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 5e64dd3..70167af 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -6,8 +6,11 @@ on: pull_request: workflow_dispatch: +# The build needs nothing beyond the source. Write access to the repository +# is granted to the deploy job alone, below, so a pull request build cannot +# push to gh-pages. permissions: - contents: write + contents: read jobs: # Build on every pull request as well as on main, so a change to the docs or to @@ -55,6 +58,8 @@ jobs: group: gh-pages-deploy cancel-in-progress: false runs-on: ubuntu-latest + permissions: + contents: write steps: - name: Checkout uses: actions/checkout@v7