Skip to content

Commit 8e1f9df

Browse files
nicholasionicholasio
authored
Fix/workflows (#944)
<!-- Filling out this template is required. Any PR that does not include enough information to be reviewed may be closed at a maintainers' discretion. All new code requires documentation and tests to ensure against regressions. --> ### Description of the Change This pull request updates the permissions configuration for several GitHub Actions workflows to explicitly declare the minimum required permissions for each workflow. This improves security by restricting token access to only what is needed for each workflow to run. **Permissions configuration updates:** * Build and test workflows now explicitly request read-only access to repository contents in `.github/workflows/build-test.yml`, `.github/workflows/eslint.yml`, `.github/workflows/phpcs.yml`, `.github/workflows/phpunit.yml`, and `.github/workflows/unit-tests.yml`. [[1]](diffhunk://#diff-063ca77e012f959eba648db60e6868875fd1e70e5f5ac081193d848f8d61ef32R3-R5) [[2]](diffhunk://#diff-8deb4e00ff9e68f9e5e25914b8d329a413bfbc90ab5f8c97662324cc68903d2fR3-R5) [[3]](diffhunk://#diff-f621c7ec73ae73c758a64d5f030f2062fc73f50676d953035650636c052aac3fR3-R5) [[4]](diffhunk://#diff-ea12f60188cdd90bc99e5d0af2eb91647bbe4a9199176aa1ec5240f65efed510R3-R5) [[5]](diffhunk://#diff-cd0effce06f425599e96952f4d5f684641a683f46d9909e7c74a9f8b2f03ccd3R3-R5) * Next.js bundle analysis workflows now request read access to contents, actions, and write access to pull requests and issues in `.github/workflows/nextjs_bundle_analysis.yml`, and read access to contents plus write access to pull requests in `.github/workflows/nextjs_bundle_analysis-app-router.yml`. [[1]](diffhunk://#diff-8e0a7a766ad2cd76e466f888588b429cc3ec2e7459922f23ba3318cdbbb717ccR3-R8) [[2]](diffhunk://#diff-961d6d47fa79510b59cd9e0a834b2c3ca9801275b0966575975c8f7da2123c1fR3-R6) **Deployment and release workflows:** * Documentation and plugin release workflows now request write access to repository contents in `.github/workflows/deploy-docs.yml`, `.github/workflows/deploy_wp_plugin_develop.yml`, and `.github/workflows/deploy_wp_plugin_stable.yml`. [[1]](diffhunk://#diff-87e860af4b9db6c503ed680b6edb6333c6f8d7659f7d1a779a2487466bbc50f6R3-R5) [[2]](diffhunk://#diff-3d99b2488c93390ca86cc977b694f9cc74dcf65f7831647de98a2c89fb1482a0R6-R8) [[3]](diffhunk://#diff-0240fd10c70c8e4f3f41205fca6000d9c94375d3261704421e293dfdd88d9a90R5-R7) * NPM and latest release workflows now request write access to contents and pull requests in `.github/workflows/npm-release-next-version.yml` and `.github/workflows/release-latest-version.yml`. [[1]](diffhunk://#diff-5536fddf891f68eb3fdc10b71c35df9377033bb2ba1abd34d18820bc8546d02bR3-R6) [[2]](diffhunk://#diff-49c17d1b9a3868bc6d7d9d28d87c9a899ae29a0bb60c3f0e6eed8f6dc9bff4d9R3-R6) ### How to test the Change <!-- Please provide steps on how to test or validate that the change in this PR works as described. --> ### Changelog Entry <!-- Please include a summary for this PR, noting whether this is something being Added / Changed / Deprecated / Removed / Fixed / or Security related. You can replace the sample entries after this comment block with the single changelog entry line for this PR. --> n/a ### Credits <!-- Please list any and all contributors on this PR so that they can be added to this projects CREDITS.md file. --> Props @jeffpaul. ### Checklist: <!--- Go over all the following points, and put an `x` in all the boxes that apply. --> <!--- If you are unsure about any of these, please ask for clarification. We are here to help! --> - [ ] I agree to follow this project's [**Code of Conduct**](https://github.com/10up/.github/blob/trunk/CODE_OF_CONDUCT.md). - [ ] I have updated the documentation accordingly. - [ ] I have added [Critical Flows, Test Cases, and/or End-to-End Tests](https://10up.github.io/Open-Source-Best-Practices/testing/) to cover my change. - [ ] All new and existing tests pass. <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Workflow-only permission scoping change; low functional risk, with the main risk being CI/deploy jobs failing if any required permission was missed. > > **Overview** > Adds explicit `permissions` blocks across GitHub Actions workflows to follow least-privilege defaults. > > CI/test workflows are restricted to `contents: read`, while release/deploy workflows grant `contents: write` (and where needed `pull-requests: write`, plus `actions: read`/`issues: write` for bundle analysis) so they can publish artifacts and comment/update PRs. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 6db0242. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup> <!-- /CURSOR_SUMMARY --> <!-- BUGBOT_STATUS --><sup><a href="https://cursor.com/dashboard?tab=bugbot">Cursor Bugbot</a> found 1 potential issue for commit <u>6db0242</u></sup><!-- /BUGBOT_STATUS -->
2 parents 335f73b + 6db0242 commit 8e1f9df

12 files changed

Lines changed: 42 additions & 0 deletions

‎.github/workflows/build-test.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
name: Build Test
22

3+
permissions:
4+
contents: read
5+
36
on: [pull_request]
47

58
jobs:

‎.github/workflows/deploy-docs.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
name: Deploy to GitHub Pages
22

3+
permissions:
4+
contents: write
5+
36
on:
47
push:
58
branches:

‎.github/workflows/deploy_wp_plugin_develop.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,9 @@
33

44
name: Release develop WP Plugin
55

6+
permissions:
7+
contents: write
8+
69
on:
710
push:
811
branches:

‎.github/workflows/deploy_wp_plugin_stable.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@ name: Release Stable WP Plugin
22

33
### This has been merged into release-latest-version action
44

5+
permissions:
6+
contents: write
7+
58
on:
69
push:
710
branches:

‎.github/workflows/eslint.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
name: eslint
22

3+
permissions:
4+
contents: read
5+
36
on: [pull_request]
47

58
jobs:

‎.github/workflows/nextjs_bundle_analysis-app-router.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
name: '(App Router) Next.js Bundle Analysis'
22

3+
permissions:
4+
contents: read
5+
pull-requests: write
6+
37
on:
48
pull_request:
59
push:

‎.github/workflows/nextjs_bundle_analysis.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
name: '(Pages Router) Next.js Bundle Analysis'
22

3+
permissions:
4+
contents: read
5+
actions: read
6+
pull-requests: write
7+
issues: write
8+
39
on:
410
pull_request:
511
push:

‎.github/workflows/npm-release-next-version.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
name: Release @next
22

3+
permissions:
4+
contents: write
5+
pull-requests: write
6+
37
on:
48
push:
59
branches:

‎.github/workflows/phpcs.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
name: PHPCS check
22

3+
permissions:
4+
contents: read
5+
36
on: pull_request
47

58
jobs:

‎.github/workflows/phpunit.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
name: PHPUnit tests
22

3+
permissions:
4+
contents: read
5+
36
on: pull_request
47

58
jobs:

0 commit comments

Comments
 (0)