From 979b1393aed4f9c1d3d633dfc4487f8912afdb13 Mon Sep 17 00:00:00 2001 From: Josef Schlehofer Date: Mon, 14 Sep 2026 13:48:29 +0200 Subject: [PATCH] ci: limit GITHUB_TOKEN permissions The workflow does not set any permissions, so every job gets the repository default, which grants write access to everything. Drop all permissions by default and grant each job only what it needs: reading the repository, and writing packages to push to ghcr.io. Signed-off-by: Josef Schlehofer --- .github/workflows/containers.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.github/workflows/containers.yml b/.github/workflows/containers.yml index 94a1b71..74c3225 100644 --- a/.github/workflows/containers.yml +++ b/.github/workflows/containers.yml @@ -30,6 +30,8 @@ on: description: "Prefix for the image name (add '-' at the end)" required: false +permissions: {} + jobs: dispatch-scheduled-rebuilds: name: Dispatch scheduled rebuilds @@ -50,6 +52,8 @@ jobs: name: Set matrix runs-on: ubuntu-latest if: github.event_name != 'schedule' + permissions: + contents: read outputs: imagebuilders: ${{ steps.find_targets.outputs.imagebuilders }} @@ -181,6 +185,9 @@ jobs: name: ImageBuilder runs-on: ubuntu-latest needs: generate_matrix + permissions: + contents: read + packages: write strategy: fail-fast: False matrix: ${{fromJson(needs.generate_matrix.outputs.imagebuilders)}} @@ -269,6 +276,9 @@ jobs: name: SDK runs-on: ubuntu-latest needs: generate_matrix + permissions: + contents: read + packages: write strategy: fail-fast: False matrix: ${{fromJson(needs.generate_matrix.outputs.sdks)}} @@ -422,6 +432,9 @@ jobs: name: RootFS runs-on: ubuntu-latest needs: generate_matrix + permissions: + contents: read + packages: write if: needs.generate_matrix.outputs.rootfs != '{"include":[]}' strategy: fail-fast: False