Skip to content

ci: declare workflow-level contents: read on maven, pr-checks, version-increments#3322

Merged
akurtakov merged 2 commits into
eclipse-platform:masterfrom
arpitjain099:chore/declare-workflow-perms
Jun 2, 2026
Merged

ci: declare workflow-level contents: read on maven, pr-checks, version-increments#3322
akurtakov merged 2 commits into
eclipse-platform:masterfrom
arpitjain099:chore/declare-workflow-perms

Conversation

@arpitjain099
Copy link
Copy Markdown
Contributor

@arpitjain099 arpitjain099 commented May 25, 2026

Adds workflow-level permissions: contents: read to three workflows that just run build / checks: maven, pr-checks, version-increments. No GitHub API writes.

Same post-CVE-2025-30066 (tj-actions/changed-files) hardening pattern. YAML validated locally.

@arpitjain099 arpitjain099 force-pushed the chore/declare-workflow-perms branch from 97786d7 to a97ce40 Compare May 26, 2026 06:32
@arpitjain099 @akurtakov
ci: declare workflow-level contents: read on maven, pr-checks, versio…
0653041 
…n-increments

Three workflows that just run build/checks. No GitHub API writes from the workflows. contents: read at workflow level is appropriate.

Post-CVE-2025-30066 hardening pattern. yaml.safe_load validated.

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
@akurtakov akurtakov force-pushed the chore/declare-workflow-perms branch from a97ce40 to 0653041 Compare May 30, 2026 09:30
@akurtakov akurtakov requested a review from HannesWell May 30, 2026 09:30
@akurtakov
Copy link
Copy Markdown
Member

akurtakov commented Jun 1, 2026 •
edited
Loading

There is smth wrong with this PR:

Invalid workflow file: .github/workflows/pr-checks.yml#L16
The workflow is not valid. .github/workflows/pr-checks.yml (Line: 16, Col: 3): Error calling workflow 'eclipse-platform/eclipse.platform.releng.aggregator/.github/workflows/verifyFreezePeriod.yml@master'. The workflow is requesting 'issues: read', but is only allowed 'issues: none'.

from https://github.com/eclipse-platform/eclipse.platform.swt/actions/runs/26680432597

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Jun 1, 2026 •
edited
Loading

Test Results

  182 files  + 2    182 suites  +2   25m 26s ⏱️ -33s
4 729 tests + 5  4 706 ✅ + 6   23 💤 ±0  0 ❌  - 1 
6 848 runs  +66  6 685 ✅ +65  163 💤 +2  0 ❌  - 1 

Results for commit 82c96b4. ± Comparison against base commit 3bde9ff.

♻️ This comment has been updated with latest results.

@arpitjain099
ci: scope contents: read to the standalone job in pr-checks
82c96b4 
The workflow-level permissions block set every other scope to none, which
broke the three reusable-workflow callers. verifyFreezePeriod.yml requests
issues: read, so the caller rejected it with 'requesting issues: read, but
is only allowed issues: none'.

Move contents: read down to the check-javadoc-consistency job, which is the
only standalone job that uses GITHUB_TOKEN for checkout. The reusable
callers keep their default token context so their own declared permissions
apply unchanged.

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
@arpitjain099
Copy link
Copy Markdown
Contributor Author

arpitjain099 commented Jun 2, 2026

Thanks for catching that @akurtakov, and sorry for the breakage. You're right: the workflow-level permissions: contents: read set every other scope to none, which conflicts with the reusable verifyFreezePeriod.yml that requests issues: read.

I have moved contents: read down to the check-javadoc-consistency job (the only standalone job here that uses GITHUB_TOKEN for checkout) and removed the workflow-level block, so the three reusable callers run with their normal token context again. The other two files in this PR don't have this problem: maven.yml's local build.yml declares no permissions, and version-increments.yml's publishVersionCheckResults.yml declares permissions: {} and does its work via the bot PAT, so both stay within contents: read.

Workflow file should validate now.

@akurtakov akurtakov merged commit db95f09 into eclipse-platform:master Jun 2, 2026
24 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@HannesWell HannesWell Awaiting requested review from HannesWell

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@arpitjain099 @akurtakov