From 0267363f36d06f0006275bccd25ef380d7a56b38 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Tue, 14 Jul 2026 15:51:17 +0000 Subject: [PATCH 1/3] Drop unnecessary pull-requests: write from the Maven CI job The build job's steps never use GITHUB_TOKEN to write to PRs (SonarCloud and Codecov decorate PRs via their own GitHub Apps), so pull-requests: write is unneeded. Reduce to least privilege: contents: read + checks: write. Refs java-helpers/simple-builders#165 Co-Authored-By: Andreas Igel --- .github/workflows/maven.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml index 2f7e1ae4..282eef96 100644 --- a/.github/workflows/maven.yml +++ b/.github/workflows/maven.yml @@ -19,9 +19,11 @@ jobs: build: runs-on: ubuntu-latest + # Least privilege: the build job only reads the repo and writes check + # output. SonarCloud/Codecov PR decoration is done by their GitHub Apps, + # not the workflow token, so pull-requests: write is not needed here. permissions: contents: read - pull-requests: write checks: write steps: From c1c8d1f4e25893ba9fcfa47ab974e2dbb7d12c3a Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Sun, 19 Jul 2026 11:01:46 +0000 Subject: [PATCH 2/3] Clarify why pull-requests: write is dropped (token-based decoration) Co-Authored-By: Andreas Igel --- .github/workflows/maven.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml index 282eef96..936a058f 100644 --- a/.github/workflows/maven.yml +++ b/.github/workflows/maven.yml @@ -20,8 +20,10 @@ jobs: runs-on: ubuntu-latest # Least privilege: the build job only reads the repo and writes check - # output. SonarCloud/Codecov PR decoration is done by their GitHub Apps, - # not the workflow token, so pull-requests: write is not needed here. + # output. No step uses the workflow token to write to pull requests, and + # SonarCloud/Codecov PR decoration is done server-side using tokens + # configured in their project settings (not the workflow GITHUB_TOKEN). + # This permission predates those integrations and is unused, so drop it. permissions: contents: read checks: write From e0cd08655f25a727591c81fd11a3492d11c533ea Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Mon, 20 Jul 2026 09:47:04 +0000 Subject: [PATCH 3/3] Comment only the retained workflow permissions in Maven CI Co-Authored-By: Andreas Igel --- .github/workflows/maven.yml | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml index 00b613df..12d708cc 100644 --- a/.github/workflows/maven.yml +++ b/.github/workflows/maven.yml @@ -19,11 +19,9 @@ jobs: build: runs-on: ubuntu-latest - # Least privilege: the build job only reads the repo and writes check - # output. No step uses the workflow token to write to pull requests, and - # SonarCloud/Codecov PR decoration is done server-side using tokens - # configured in their project settings (not the workflow GITHUB_TOKEN). - # This permission predates those integrations and is unused, so drop it. + # Least privilege: read the repository (checkout + build) and write + # check-run output (test/analysis results). No step uses the workflow + # token to write to pull requests. permissions: contents: read checks: write