From 96da81e7dd888bbaec22ecb095fb651d295ccd40 Mon Sep 17 00:00:00 2001 From: Josh Sokol Date: Fri, 21 Aug 2026 11:56:23 -0500 Subject: [PATCH] ci: declare per-workflow permissions and move registry creds to environments Prep so the repo-level default GITHUB_TOKEN can be set to read-only. - Every workflow now declares an explicit `permissions:` block. create_new_tag.yml is the only one that needs contents: write (it tags and pushes tags); the rest are contents: read. - push-to-gh-pkgs.yml grants packages + id-token write at the caller level: a reusable workflow can only downgrade the caller's token, never escalate, so a bare contents:read caller would break the callee's ghcr push and cosign sign. - The jobs that use the Docker Hub credentials now declare an environment, so those credentials become environment-scoped with a deployment-branch policy rather than repo-wide: publish-testing.yml -> environment: testing (branch: testing) promote-latest.yml -> environment: release (branch: master) push-to-dockerhub_rw.yml -> environment: release (branch: master) This matches how the AWS OIDC roles are already scoped by ref. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/container-validation.yml | 3 +++ .github/workflows/create_new_tag.yml | 3 +++ .github/workflows/promote-latest.yml | 1 + .github/workflows/publish-testing.yml | 1 + .github/workflows/push-to-dockerhub.yml | 3 +++ .github/workflows/push-to-dockerhub_rw.yml | 1 + .github/workflows/push-to-gh-pkgs.yml | 5 +++++ .github/workflows/shellcheck.yml | 3 +++ 8 files changed, 20 insertions(+) diff --git a/.github/workflows/container-validation.yml b/.github/workflows/container-validation.yml index 730dba5..78a710e 100644 --- a/.github/workflows/container-validation.yml +++ b/.github/workflows/container-validation.yml @@ -5,6 +5,9 @@ on: pull_request: branches: [ master ] +permissions: + contents: read + jobs: simplerisk-jammy: name: 'Verify simplerisk/simplerisk image based on Ubuntu 22.04 (Jammy)' diff --git a/.github/workflows/create_new_tag.yml b/.github/workflows/create_new_tag.yml index 00a15b4..bbdf2b0 100644 --- a/.github/workflows/create_new_tag.yml +++ b/.github/workflows/create_new_tag.yml @@ -4,6 +4,9 @@ on: push: branches: [ "master" ] +permissions: + contents: write # git tag + git push --tags + jobs: create-release: runs-on: ubuntu-latest diff --git a/.github/workflows/promote-latest.yml b/.github/workflows/promote-latest.yml index 750a6e0..d8af9f9 100644 --- a/.github/workflows/promote-latest.yml +++ b/.github/workflows/promote-latest.yml @@ -46,6 +46,7 @@ env: jobs: promote: + environment: release runs-on: ubuntu-latest steps: - name: Checkout diff --git a/.github/workflows/publish-testing.yml b/.github/workflows/publish-testing.yml index d25fc2b..7a8e6bd 100644 --- a/.github/workflows/publish-testing.yml +++ b/.github/workflows/publish-testing.yml @@ -42,6 +42,7 @@ env: jobs: publish: + environment: testing runs-on: ubuntu-latest timeout-minutes: 40 steps: diff --git a/.github/workflows/push-to-dockerhub.yml b/.github/workflows/push-to-dockerhub.yml index a0dd924..c9c5f02 100644 --- a/.github/workflows/push-to-dockerhub.yml +++ b/.github/workflows/push-to-dockerhub.yml @@ -19,6 +19,9 @@ name: Push images to DockerHub on: workflow_dispatch: +permissions: + contents: read + # On a job that uses a reusable workflow, it seems you cannot # use env on a with block (https://github.com/actions/runner/issues/1189#issuecomment-1741672276) env: diff --git a/.github/workflows/push-to-dockerhub_rw.yml b/.github/workflows/push-to-dockerhub_rw.yml index 16e66b7..c4fe8da 100644 --- a/.github/workflows/push-to-dockerhub_rw.yml +++ b/.github/workflows/push-to-dockerhub_rw.yml @@ -42,6 +42,7 @@ on: jobs: dockerhub: + environment: release runs-on: ubuntu-latest steps: - name: Checkout repository diff --git a/.github/workflows/push-to-gh-pkgs.yml b/.github/workflows/push-to-gh-pkgs.yml index 8152167..6c64788 100644 --- a/.github/workflows/push-to-gh-pkgs.yml +++ b/.github/workflows/push-to-gh-pkgs.yml @@ -15,6 +15,11 @@ name: Push images to GitHub Packages on: workflow_dispatch: +permissions: + contents: read + packages: write # callee push-to-gh-pkgs_rw pushes to ghcr.io + id-token: write # callee cosign-signs via sigstore/fulcio + # On a job that uses a reusable workflow, it seems you cannot # use env on a with block (https://github.com/actions/runner/issues/1189#issuecomment-1741672276) env: diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml index d468de4..e02f773 100644 --- a/.github/workflows/shellcheck.yml +++ b/.github/workflows/shellcheck.yml @@ -4,6 +4,9 @@ on: pull_request: branches: [ master ] +permissions: + contents: read + jobs: shellcheck: name: ShellCheck