From ba6923f6a67250c17ba1fa73395e1707fc77817b Mon Sep 17 00:00:00 2001 From: Adnan Khan Date: Mon, 20 Oct 2025 22:44:58 -0400 Subject: [PATCH 1/4] Scope down GitHub token permissions for host-plugin-npm-publish.yml --- .github/workflows/host-plugin-npm-publish.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/host-plugin-npm-publish.yml b/.github/workflows/host-plugin-npm-publish.yml index 6fd6f6e..509b027 100644 --- a/.github/workflows/host-plugin-npm-publish.yml +++ b/.github/workflows/host-plugin-npm-publish.yml @@ -4,6 +4,10 @@ on: release: types: [created] + +permissions: + contents: read + defaults: run: working-directory: "./open-source-hosts-plugin" From ebd415de6a0f40d5bc0e4075697da4ff00e9e546 Mon Sep 17 00:00:00 2001 From: Adnan Khan Date: Mon, 20 Oct 2025 22:45:03 -0400 Subject: [PATCH 2/4] Scope down GitHub token permissions for amplify-plugin-pull-request.yml --- .github/workflows/amplify-plugin-pull-request.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/amplify-plugin-pull-request.yml b/.github/workflows/amplify-plugin-pull-request.yml index ab4dd19..58ebc0a 100644 --- a/.github/workflows/amplify-plugin-pull-request.yml +++ b/.github/workflows/amplify-plugin-pull-request.yml @@ -3,6 +3,11 @@ name: Build/test/lint/CodeQL Publish Plugin on: pull_request: + +permissions: + contents: read + security-events: write + defaults: run: working-directory: "./aws-amplify-publisher-plugin" From 91109eefc07e760bfc39dd1214f21c44a83281f2 Mon Sep 17 00:00:00 2001 From: Adnan Khan Date: Mon, 20 Oct 2025 22:45:08 -0400 Subject: [PATCH 3/4] Scope down GitHub token permissions for amplify-plugin-npm-publish.yml --- .github/workflows/amplify-plugin-npm-publish.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/amplify-plugin-npm-publish.yml b/.github/workflows/amplify-plugin-npm-publish.yml index da28764..381c4fe 100644 --- a/.github/workflows/amplify-plugin-npm-publish.yml +++ b/.github/workflows/amplify-plugin-npm-publish.yml @@ -4,6 +4,10 @@ on: release: types: [created] + +permissions: + contents: read + defaults: run: working-directory: "./aws-amplify-publisher-plugin" From 7dc893a32c7a01e69f30662052cfc2dbf4258799 Mon Sep 17 00:00:00 2001 From: Adnan Khan Date: Mon, 20 Oct 2025 22:45:12 -0400 Subject: [PATCH 4/4] Scope down GitHub token permissions for host-plugin-pull-request.yml --- .github/workflows/host-plugin-pull-request.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/host-plugin-pull-request.yml b/.github/workflows/host-plugin-pull-request.yml index eaf806c..7514355 100644 --- a/.github/workflows/host-plugin-pull-request.yml +++ b/.github/workflows/host-plugin-pull-request.yml @@ -3,6 +3,11 @@ name: Build/test/lint/CodeQL Host Plugin on: pull_request: + +permissions: + contents: read + security-events: write + jobs: build: runs-on: ${{ matrix.os }}