Skip to content

fix(security): scope pipeline.yml permissions per-job instead of workflow-wide #528

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Copilot wants to merge 4 commits into
base: main
Choose a base branch
from
Open

fix(security): scope pipeline.yml permissions per-job instead of workflow-wide #528

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
0d67b3e
Initial plan
Copilot Mar 27, 2026
e7258ab
fix: scope workflow permissions per-job in pipeline.yml
Copilot Mar 27, 2026
230a035
chore: update workflow refs to pinned hashes from main
Copilot Mar 28, 2026
e497379
Merge branch 'main' into copilot/fix-workflow-permissions-pipeline
ntnn Mar 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 17 additions & 4 deletions .github/workflows/pipeline.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,4 @@
name: pipeline
permissions:
contents: write
pull-requests: write
packages: write
on:
workflow_call:
inputs:
Expand Down Expand Up @@ -84,20 +80,29 @@ on:
jobs:
auto-labeler:
if: ${{ (github.head_ref || github.ref) != format('refs/heads/{0}',inputs.release_branch) }}
permissions:
pull-requests: write
contents: read
uses: platform-mesh/.github/.github/workflows/job-auto-labeler.yml@07550bab80de7691f4947214ee342351896e209b # main
secrets: inherit

createVersion:
if: ${{ (github.head_ref || github.ref) == format('refs/heads/{0}',inputs.release_branch) }}
permissions:
contents: write
uses: platform-mesh/.github/.github/workflows/job-create-version.yml@07550bab80de7691f4947214ee342351896e209b # main
secrets: inherit

lint:
permissions:
contents: read
uses: platform-mesh/.github/.github/workflows/job-golang-lint.yml@07550bab80de7691f4947214ee342351896e209b # main
with:
useTask: ${{ inputs.useTask }}

testSource:
permissions:
contents: read
uses: ./.github/workflows/job-golang-test-source.yml
secrets: inherit
with:
Expand All @@ -110,6 +115,9 @@ jobs:

dockerBuild:
if: ${{ (github.head_ref || github.ref) != format('refs/heads/{0}',inputs.release_branch) }}
permissions:
packages: write
contents: read
uses: platform-mesh/.github/.github/workflows/job-docker-build-push.yml@07550bab80de7691f4947214ee342351896e209b # main
with:
imageTagName: ${{ inputs.imageTagName }}
Expand All @@ -120,6 +128,9 @@ jobs:
dockerBuildAndPush:
if: ${{ (github.head_ref || github.ref) == format('refs/heads/{0}',inputs.release_branch) }}
needs: [createVersion,lint,testSource]
permissions:
packages: write
contents: read
uses: platform-mesh/.github/.github/workflows/job-docker-build-push.yml@07550bab80de7691f4947214ee342351896e209b # main
with:
imageTagName: ${{ inputs.imageTagName }}
Expand All @@ -131,6 +142,8 @@ jobs:
updateVersion:
needs: [createVersion, dockerBuildAndPush]
if: ${{ (github.head_ref || github.ref) == format('refs/heads/{0}',inputs.release_branch) }}
permissions:
contents: read
uses: platform-mesh/.github/.github/workflows/job-chart-version-update.yml@07550bab80de7691f4947214ee342351896e209b # main
secrets: inherit
with:
Expand Down
Loading