From 13115a806c749bf8890c74b9d8c09a5d14d9d206 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 17 Jul 2026 21:01:40 +0000 Subject: [PATCH 1/2] chore: harden workflow permissions Co-authored-by: pethers <1726836+pethers@users.noreply.github.com> --- .github/workflows/javadoc-generation.yml | 2 +- .github/workflows/release.yml | 4 ---- .github/workflows/site-generation.yml | 2 +- 3 files changed, 2 insertions(+), 6 deletions(-) diff --git a/.github/workflows/javadoc-generation.yml b/.github/workflows/javadoc-generation.yml index 129694229c..856b38e7c2 100644 --- a/.github/workflows/javadoc-generation.yml +++ b/.github/workflows/javadoc-generation.yml @@ -26,7 +26,7 @@ jobs: runs-on: ubuntu-26.04 timeout-minutes: 60 permissions: - contents: write # Needed for checkout and potential deployment + contents: read # Needed for checkout pages: write # Needed for GitHub Pages deployment id-token: write # Required for attestation actions: read # Basic read access to actions diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6a15418bf1..634112707b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -21,15 +21,11 @@ jobs: cancel-in-progress: true permissions: contents: write # Needed for checkout, git-auto-commit-action, and creating releases - packages: write # Needed for publishing packages id-token: write # Required for SLSA provenance and SBOM attestation actions: read # Basic read access to actions - security-events: write # Needed for SBOM attestation - statuses: write # Required for commit statuses updated by actions issues: write # Updated to write for release-drafter pull-requests: write # Updated to write for release-drafter pages: read - deployments: write attestations: write # Required to create and persist attestations strategy: fail-fast: false diff --git a/.github/workflows/site-generation.yml b/.github/workflows/site-generation.yml index 1ea87b74ce..f8afcdfcd6 100644 --- a/.github/workflows/site-generation.yml +++ b/.github/workflows/site-generation.yml @@ -17,7 +17,7 @@ jobs: runs-on: ubuntu-26.04 timeout-minutes: 120 permissions: - contents: write # Needed for checkout and potential site deployment + contents: read # Needed for checkout pages: write # Needed for GitHub Pages deployment id-token: write # Required for attestation actions: read # Basic read access to actions From ebfc8887c9f010f140af530d1dff779aee1a891e Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 17 Jul 2026 21:20:31 +0000 Subject: [PATCH 2/2] fix: remove unused workflow token permissions Co-authored-by: pethers <1726836+pethers@users.noreply.github.com> --- .github/workflows/release.yml | 1 - .github/workflows/site-generation.yml | 2 -- 2 files changed, 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 634112707b..7722cc9992 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -25,7 +25,6 @@ jobs: actions: read # Basic read access to actions issues: write # Updated to write for release-drafter pull-requests: write # Updated to write for release-drafter - pages: read attestations: write # Required to create and persist attestations strategy: fail-fast: false diff --git a/.github/workflows/site-generation.yml b/.github/workflows/site-generation.yml index f8afcdfcd6..9feb4c9c6b 100644 --- a/.github/workflows/site-generation.yml +++ b/.github/workflows/site-generation.yml @@ -18,8 +18,6 @@ jobs: timeout-minutes: 120 permissions: contents: read # Needed for checkout - pages: write # Needed for GitHub Pages deployment - id-token: write # Required for attestation actions: read # Basic read access to actions steps: