Skip to content

chore(actions): enforce minimal workflow permissions - #467

Merged
cclauss merged 1 commit into
cpplint:developfrom
PNHD:fix/466-excessive-permissions
Aug 14, 2026
Merged

chore(actions): enforce minimal workflow permissions#467
cclauss merged 1 commit into
cpplint:developfrom
PNHD:fix/466-excessive-permissions

Conversation

@PNHD

@PNHD PNHD commented Aug 14, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

Fixes #466.

Summary

  • deny GITHUB_TOKEN permissions by default at the workflow level with permissions: {}
  • keep the existing explicit job-level permissions required for trusted publishing and GitHub releases
  • re-enable zizmor's excessive-permissions audit by removing its exclusion from zizmor.yml

This follows zizmor's recommended remediation of setting workflow-level permissions to {} and granting permissions only to jobs that require them.

The existing SHA pinning and Dependabot cooldown configuration are intentionally unchanged.

Summary by CodeRabbit

  • Security
    • Improved release workflow security by restricting default automation permissions.
    • Enabled detection of excessive permissions in workflow security checks.

@PNHD
chore(actions): enforce minimal workflow permissions
3e9c7c2 
Enable zizmor's excessive-permissions audit and deny workflow token permissions by default in the release workflow. Jobs that publish or create releases keep only their explicitly required permissions.

Fixes cpplint#466.
@coderabbitai

coderabbitai Bot commented Aug 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 871f7b8d-dcfd-4fef-9a97-fb8c3cb7c7a2

📥 Commits

Reviewing files that changed from the base of the PR and between bd2ed38 and 3e9c7c2.

📒 Files selected for processing (2)
  • .github/workflows/release.yml
  • zizmor.yml
💤 Files with no reviewable changes (1)
  • zizmor.yml
📝 Walkthrough

Walkthrough

The release workflow now disables default GitHub Actions token permissions. The zizmor configuration now checks for excessive permissions.

Changes

Workflow permission hardening

Layer / File(s) Summary
Release workflow permission controls
.github/workflows/release.yml, zizmor.yml		 The release workflow sets top-level permissions: {}. The zizmor configuration removes the disabled excessive-permissions rule.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 3e9c7

The change restricts workflow token permissions by default while retaining the explicit permissions needed for publishing and releases; no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: cclauss

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly describes the main change: enforcing minimal GitHub Actions workflow permissions.
Linked Issues check ✅ Passed The changes implement permissions hardening requested by issue #466 and re-enable the excessive-permissions audit.
Out of Scope Changes check ✅ Passed The workflow permission change and zizmor rule re-enablement directly support the stated objectives, with no unrelated changes.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@cclauss
cclauss merged commit d03e546 into cpplint:develop Aug 14, 2026
8 checks passed
@PNHD
PNHD deleted the fix/466-excessive-permissions branch August 14, 2026 09:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cclauss cclauss cclauss approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Use permissions hardening instead of pinning to SHA

2 participants

@PNHD @cclauss