fix(security): add explicit permissions to sweeper workflow - #63
Merged
pranav-new-relic merged 1 commit intoAug 11, 2026
Merged
Conversation
Adds 'permissions: contents: read' to sweeper.yml. Without an explicit permissions block, GITHUB_TOKEN inherits broad default write-access. This workflow only reads code (actions/checkout) and calls external New Relic APIs via secrets — contents: read is the minimum required.
| # Everyday at 13:00 UTC (06:00 PST) | ||
| - cron: "0 13 * * *" | ||
|
|
||
| permissions: |
Member
Author
There was a problem hiding this comment.
Why add permissions: contents: read?
By default, a GitHub Actions workflow run's GITHUB_TOKEN gets broad write-access to the repository (push branches, create releases, open issues). This is convenient but violates the principle of least privilege — code should only have the access it actually needs.
This workflow does two things:
- Checks out the code with
actions/checkout→ needscontents: read - Runs the sweep script, which calls New Relic APIs using repository secrets (the
NEW_RELIC_API_KEYetc. env vars) — theGITHUB_TOKENis never involved here
So contents: read is the minimum correct permission. If a supply-chain attack ever compromised actions/setup-go or actions/checkout, the attacker's access would be limited to reading files rather than pushing malicious code back to the repo.
Fixes: https://github.com/newrelic/observability-as-code/security/code-scanning/1
nr-developer-toolkit
approved these changes
Aug 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and Why
Fixes CodeQL alert #1 (
actions/missing-workflow-permissions), tracked in NR-560180.Change
Added
permissions: contents: readat the workflow level in.github/workflows/sweeper.yml.Why it matters: Without an explicit
permissions:block, GitHub Actions gives theGITHUB_TOKENbroad default write-access to the repository. This means if any step or dependency in the workflow were ever compromised, it could push code, create releases, or delete branches.The sweeper workflow only needs two things:
actions/checkoutto clone the code — requirescontents: readNEW_RELIC_API_KEYetc.) — these are passed directly as environment variables and don't use theGITHUB_TOKENat allSo
contents: readis the minimum correct permission.Testing
The
permissions:block is additive-only — it restricts what the token can do but doesn't affect how the workflow runs. The sweep itself will continue to execute identically.🤖 Generated with Claude Code