Set least-privilege GITHUB_TOKEN permissions on CI (API-927) - #6
Merged
kiernanmcgowan merged 1 commit intoAug 18, 2026
Conversation
The CI workflow set no explicit permissions block, so the registry job's GITHUB_TOKEN was granted the broad default scope. CodeQL flagged it as actions/missing-workflow-permissions. Read the whole job before choosing the scope: checkout, pnpm setup, install, typecheck, lint, test, build, and a git diff --exit-code r/ freshness check. Nothing publishes to npm, pushes a tag, or comments on the PR, so no step needs a write scope and contents: read covers all nine. Set at the top level rather than per-job so a job added later inherits least privilege instead of the default, matching API-885 in the logo repo and the arena half of this ticket. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
alexbaldwin
deleted the
kiernan/api-927-set-least-privilege-github_token-permissions-logo-api
branch
September 1, 2026 20:33
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes API-927.
This is the logo-api half. The arena half shipped as arena#7 (merged); with this one the ticket is complete.
Problem
.github/workflows/ci.ymlset no explicitpermissions:block, so theregistryjob'sGITHUB_TOKENreceived the broad default scope. Least-privilege on the Actions token is a supply-chain hardening item — a compromised action in the job could otherwise use the token to write to the repo.Change
Added a top-level
permissions: contents: read.The ticket's plan called for reading the whole job before picking a scope, since this repo is the public SDK and an npm publish step was plausible. All nine steps checked: checkout,
pnpm/action-setup,setup-node,pnpm install --frozen-lockfile,pnpm typecheck,pnpm lint,pnpm test,pnpm build, andgit diff --exit-code r/(the built-registry freshness check). None publishes to npm, pushes a tag, or comments on the PR — so no step needs a write scope, and no carve-out is required.Placed at the top level rather than on the job, so a job added later inherits least privilege instead of the broad default. Matches API-885 / logo#789 and the arena half.
Tests
No code change, so no test change. Verified the workflow still parses with its structure intact (
permissions: {'contents': 'read'}, oneregistryjob, nine steps).This PR's own CI run is the check that matters: a green
registryjob proves the narrowed token scope did not break install, typecheck, lint, test, build, or the registry-sync assertion.Security alerts
actions/missing-workflow-permissions(medium, due 2026-10-06) — https://github.com/logo-dev/logo-api/security/code-scanning/1🤖 Generated with Claude Code