From fe66f9ba41927c05e211056f818d381c62959eda Mon Sep 17 00:00:00 2001 From: Jesse Hills <3060199+jesserockz@users.noreply.github.com> Date: Mon, 11 May 2026 17:15:53 +1200 Subject: [PATCH] [ci] Tighten workflow permissions to least-privilege (#16349) --- .github/workflows/auto-label-pr.yml | 9 +++++++-- .github/workflows/ci-api-proto.yml | 4 ++-- .github/workflows/ci-clang-tidy-hash.yml | 4 ++-- .github/workflows/ci-docker.yml | 3 +-- .github/workflows/ci-memory-impact-comment.yml | 6 +++--- .github/workflows/ci.yml | 6 +++--- .../close-pr-from-fork-default-branch.yml | 4 ++-- .../codeowner-approved-label-update.yml | 6 +++--- .github/workflows/codeql.yml | 16 +++++++--------- .github/workflows/external-component-bot.yml | 5 ++--- .github/workflows/issue-codeowner-notify.yml | 4 ++-- .github/workflows/lock.yml | 6 ++++++ .github/workflows/pr-title-check.yml | 4 ++-- .github/workflows/release.yml | 17 ++++++++++------- .github/workflows/stale.yml | 4 ++-- .github/workflows/status-check-labels.yml | 3 +++ 16 files changed, 57 insertions(+), 44 deletions(-) diff --git a/.github/workflows/auto-label-pr.yml b/.github/workflows/auto-label-pr.yml index ea22f75ef..2d000658a 100644 --- a/.github/workflows/auto-label-pr.yml +++ b/.github/workflows/auto-label-pr.yml @@ -6,9 +6,10 @@ on: pull_request_target: types: [labeled, opened, reopened, synchronize, edited] +# All PR/label/review writes are performed with the App token minted below, +# so the workflow's GITHUB_TOKEN only needs read access for checkout. permissions: - pull-requests: write - contents: read + contents: read # actions/checkout reads the workflow source env: SMALL_PR_THRESHOLD: 30 @@ -31,6 +32,10 @@ jobs: with: client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }} private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }} + # Scope the minted App token to the minimum needed by auto-label-pr/*.js. + permission-contents: read # repos.getContent for CODEOWNERS and file lookups in detectors.js + permission-issues: write # listLabelsOnIssue, addLabels, removeLabel, list/createComment + permission-pull-requests: write # pulls.listFiles, list/create/update/dismissReview - name: Auto Label PR uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 diff --git a/.github/workflows/ci-api-proto.yml b/.github/workflows/ci-api-proto.yml index e5143911d..2f7fd271b 100644 --- a/.github/workflows/ci-api-proto.yml +++ b/.github/workflows/ci-api-proto.yml @@ -12,8 +12,8 @@ on: - ".github/workflows/ci-api-proto.yml" permissions: - contents: read - pull-requests: write + contents: read # actions/checkout for the PR head + pull-requests: write # pulls.createReview / listReviews / dismissReview when generated proto files are stale jobs: check: diff --git a/.github/workflows/ci-clang-tidy-hash.yml b/.github/workflows/ci-clang-tidy-hash.yml index 40cdff0cb..d9148fb06 100644 --- a/.github/workflows/ci-clang-tidy-hash.yml +++ b/.github/workflows/ci-clang-tidy-hash.yml @@ -12,8 +12,8 @@ on: - ".github/workflows/ci-clang-tidy-hash.yml" permissions: - contents: read - pull-requests: write + contents: read # actions/checkout for the PR head + pull-requests: write # pulls.createReview / listReviews / dismissReview when the clang-tidy hash is out of date jobs: verify-hash: diff --git a/.github/workflows/ci-docker.yml b/.github/workflows/ci-docker.yml index 4009ac1e1..3fd17888c 100644 --- a/.github/workflows/ci-docker.yml +++ b/.github/workflows/ci-docker.yml @@ -22,8 +22,7 @@ on: - "script/platformio_install_deps.py" permissions: - contents: read - packages: read + contents: read # actions/checkout only; the build does not push images concurrency: # yamllint disable-line rule:line-length diff --git a/.github/workflows/ci-memory-impact-comment.yml b/.github/workflows/ci-memory-impact-comment.yml index fbcf5ea58..025b96098 100644 --- a/.github/workflows/ci-memory-impact-comment.yml +++ b/.github/workflows/ci-memory-impact-comment.yml @@ -7,9 +7,9 @@ on: types: [completed] permissions: - contents: read - pull-requests: write - actions: read + contents: read # actions/checkout of the base repo at the PR's target branch + pull-requests: write # gh api to look up the PR by head SHA and post/update the memory-impact comment + actions: read # gh run download for the memory-analysis artifacts produced by the CI workflow run jobs: memory-impact-comment: diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9909d7a5d..7cb8e07af 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,7 +17,7 @@ on: merge_group: permissions: - contents: read + contents: read # actions/checkout for all jobs; individual jobs add their own scopes when they need to write env: DEFAULT_PYTHON: "3.11" @@ -1147,8 +1147,8 @@ jobs: - memory-impact-pr-branch if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && fromJSON(needs.determine-jobs.outputs.memory_impact).should_run == 'true' && needs.memory-impact-target-branch.outputs.skip != 'true' permissions: - contents: read - pull-requests: write + contents: read # actions/checkout to load the comment-posting script + pull-requests: write # ci_memory_impact_comment.py posts/updates the memory-impact comment on the PR env: GH_TOKEN: ${{ github.token }} steps: diff --git a/.github/workflows/close-pr-from-fork-default-branch.yml b/.github/workflows/close-pr-from-fork-default-branch.yml index 1cd70f5ef..5180a0718 100644 --- a/.github/workflows/close-pr-from-fork-default-branch.yml +++ b/.github/workflows/close-pr-from-fork-default-branch.yml @@ -6,8 +6,8 @@ on: types: [opened, reopened] permissions: - pull-requests: write - issues: write + pull-requests: write # pulls.update to close the PR opened from a fork's default branch + issues: write # issues.createComment to explain to the contributor why the PR was closed jobs: close: diff --git a/.github/workflows/codeowner-approved-label-update.yml b/.github/workflows/codeowner-approved-label-update.yml index 49653b6fb..013517bde 100644 --- a/.github/workflows/codeowner-approved-label-update.yml +++ b/.github/workflows/codeowner-approved-label-update.yml @@ -15,9 +15,9 @@ on: - beta permissions: - issues: write - pull-requests: read - contents: read + issues: write # issues.addLabels / removeLabel to manage the 'code-owner-approved' label on the PR + pull-requests: read # listReviews to determine whether a codeowner has approved + contents: read # actions/checkout to read CODEOWNERS and the shared codeowners.js helper jobs: codeowner-approved: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 949e45e45..0a4dd9a92 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -16,6 +16,9 @@ on: schedule: - cron: "30 18 * * 4" +# Deny by default; the analyze job opts in to exactly what it needs. +permissions: {} + jobs: analyze: name: Analyze (${{ matrix.language }}) @@ -26,15 +29,10 @@ jobs: # Consider using larger runners or machines with greater resources for possible analysis time improvements. runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} permissions: - # required for all workflows - security-events: write - - # required to fetch internal or private CodeQL packs - packages: read - - # only required for workflows in private repositories - actions: read - contents: read + security-events: write # upload CodeQL SARIF results to the Code Scanning API + packages: read # fetch internal or private CodeQL query packs + actions: read # required by codeql-action when run from a private repo + contents: read # actions/checkout to scan the repository strategy: fail-fast: false diff --git a/.github/workflows/external-component-bot.yml b/.github/workflows/external-component-bot.yml index 3165b1707..6e2bf780b 100644 --- a/.github/workflows/external-component-bot.yml +++ b/.github/workflows/external-component-bot.yml @@ -5,9 +5,8 @@ on: types: [opened, synchronize] permissions: - contents: read # Needed to fetch PR details - issues: write # Needed to create and update comments (PR comments are managed via the issues REST API) - pull-requests: write # also needed? + issues: write # issues.createComment / updateComment to post the external-component usage instructions on the PR + pull-requests: read # pulls.listFiles to enumerate which components changed jobs: external-comment: diff --git a/.github/workflows/issue-codeowner-notify.yml b/.github/workflows/issue-codeowner-notify.yml index b211c1398..bc892b64e 100644 --- a/.github/workflows/issue-codeowner-notify.yml +++ b/.github/workflows/issue-codeowner-notify.yml @@ -9,8 +9,8 @@ on: types: [labeled] permissions: - issues: write - contents: read + issues: write # issues.createComment to mention component codeowners on the newly labelled issue + contents: read # repos.getContent to fetch CODEOWNERS from the default branch jobs: notify-codeowners: diff --git a/.github/workflows/lock.yml b/.github/workflows/lock.yml index 8d1dfe857..5e7011765 100644 --- a/.github/workflows/lock.yml +++ b/.github/workflows/lock.yml @@ -6,6 +6,12 @@ on: - cron: "30 0 * * *" # Run daily at 00:30 UTC workflow_dispatch: +# Deny by default; the lock job opts in to exactly what the reusable workflow needs. +permissions: {} + jobs: lock: + permissions: + issues: write # issues.lock on closed issues + pull-requests: write # issues.lock on closed pull requests uses: esphome/workflows/.github/workflows/lock.yml@025a1e6255610c498ed590403b7e510b69e474df # 2026.4.1 diff --git a/.github/workflows/pr-title-check.yml b/.github/workflows/pr-title-check.yml index 870099627..ed0bff966 100644 --- a/.github/workflows/pr-title-check.yml +++ b/.github/workflows/pr-title-check.yml @@ -8,8 +8,8 @@ on: - beta permissions: - contents: read - pull-requests: read + contents: read # actions/checkout to load detect-tags.js + pull-requests: read # pulls.listFiles to map changed files to component/core/dashboard/ci tags jobs: check: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a16af92b6..d07c8fe63 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -9,7 +9,7 @@ on: - cron: "0 2 * * *" permissions: - contents: read + contents: read # actions/checkout for all jobs; deploy jobs add their own scopes when they need to write jobs: init: @@ -57,8 +57,8 @@ jobs: if: github.repository == 'esphome/esphome' && github.event_name == 'release' runs-on: ubuntu-latest permissions: - contents: read - id-token: write + contents: read # actions/checkout to build the sdist/wheel + id-token: write # OIDC token for PyPI Trusted Publishing (pypa/gh-action-pypi-publish) steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set up Python @@ -78,8 +78,8 @@ jobs: name: Build ESPHome ${{ matrix.platform.arch }} if: github.repository == 'esphome/esphome' permissions: - contents: read - packages: write + contents: read # actions/checkout to load Dockerfile and build context + packages: write # docker/login-action + build-push-action push image digests to ghcr.io runs-on: ${{ matrix.platform.os }} needs: [init] strategy: @@ -152,8 +152,8 @@ jobs: - deploy-docker if: github.repository == 'esphome/esphome' permissions: - contents: read - packages: write + contents: read # actions/checkout to load Dockerfile and build context + packages: write # docker/login-action + build-push-action push image digests to ghcr.io strategy: fail-fast: false matrix: @@ -227,6 +227,7 @@ jobs: private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }} owner: esphome repositories: home-assistant-addon + permission-actions: write # actions.createWorkflowDispatch on the target repo (only API call made with this token) - name: Trigger Workflow uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -262,6 +263,7 @@ jobs: private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }} owner: esphome repositories: esphome-schema + permission-actions: write # actions.createWorkflowDispatch on the target repo (only API call made with this token) - name: Trigger Workflow uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -293,6 +295,7 @@ jobs: private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }} owner: esphome repositories: version-notifier + permission-actions: write # actions.createWorkflowDispatch on the target repo (only API call made with this token) - name: Trigger Workflow uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index ba5c32e01..2e57093bb 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -7,8 +7,8 @@ on: workflow_dispatch: permissions: - issues: write - pull-requests: write + issues: write # actions/stale labels, comments on, and closes stale issues + pull-requests: write # actions/stale labels, comments on, and closes stale pull requests concurrency: group: lock diff --git a/.github/workflows/status-check-labels.yml b/.github/workflows/status-check-labels.yml index 709342e5a..d27cc0cbe 100644 --- a/.github/workflows/status-check-labels.yml +++ b/.github/workflows/status-check-labels.yml @@ -4,6 +4,9 @@ on: pull_request: types: [opened, reopened, labeled, unlabeled, synchronize] +permissions: + pull-requests: read # issues.listLabelsOnIssue to detect blocking labels (needs-docs, merge-after-release, chained-pr) + concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number }} cancel-in-progress: true