ci: add explicit permissions to GitHub Actions workflows (#1792) · stevelnn/crawlee-python@687cc12 · GitHub
Skip to content

Commit 687cc12

Browse files
vdusekclaude
vdusek
and
claude
authored
ci: add explicit permissions to GitHub Actions workflows (apify#1792)
## Summary - Adds explicit `permissions` blocks to all 8 workflow files, addressing CodeQL "Workflow does not contain permissions" security alerts - Follows the principle of least privilege: `contents: read` as the default, with elevated permissions only on jobs that need write access (releases, changelog updates, docs deployment) - Pre-existing permissions on `pypi_publish` and `_release_docs.yaml` jobs are preserved - Same as apify/apify-client-python#614 and apify#1792 --- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
1 parent 2175c12 commit 687cc12

9 files changed

Lines changed: 46 additions & 0 deletions

‎.github/workflows/_check_code.yaml‎

Lines changed: 3 additions & 0 deletions

‎.github/workflows/_check_docs.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@ on:
77
# Runs when invoked by another workflow.
88
workflow_call:
99

10+
permissions:
11+
contents: read
12+
1013
jobs:
1114
doc_checks:
1215
name: Doc checks

‎.github/workflows/_release_docs.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,9 @@ on:
1111
required: true
1212
type: string
1313

14+
permissions:
15+
contents: read
16+
1417
env:
1518
NODE_VERSION: 22
1619
PYTHON_VERSION: 3.14

‎.github/workflows/_tests.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@ on:
77
# Runs when invoked by another workflow.
88
workflow_call:
99

10+
permissions:
11+
contents: read
12+
1013
jobs:
1114
unit_tests:
1215
name: Unit tests

‎.github/workflows/manual_release_stable.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,9 @@ concurrency:
2525
group: release
2626
cancel-in-progress: false
2727

28+
permissions:
29+
contents: read
30+
2831
jobs:
2932
code_checks:
3033
name: Code checks
@@ -51,6 +54,8 @@ jobs:
5154
changelog_update:
5255
name: Changelog update
5356
needs: [release_prepare]
57+
permissions:
58+
contents: write
5459
uses: apify/workflows/.github/workflows/python_bump_and_update_changelog.yaml@main
5560
with:
5661
version_number: ${{ needs.release_prepare.outputs.version_number }}
@@ -61,6 +66,8 @@ jobs:
6166
name: GitHub release
6267
needs: [release_prepare, changelog_update]
6368
runs-on: ubuntu-latest
69+
permissions:
70+
contents: write
6471
env:
6572
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
6673
steps:
@@ -100,6 +107,10 @@ jobs:
100107
doc_release:
101108
name: Doc release
102109
needs: [changelog_update, pypi_publish]
110+
permissions:
111+
contents: write
112+
pages: write
113+
id-token: write
103114
uses: ./.github/workflows/_release_docs.yaml
104115
with:
105116
# Use the ref from the changelog update to include the updated changelog.

‎.github/workflows/on_issue.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ on:
66
types:
77
- opened
88

9+
permissions:
10+
contents: read
11+
912
jobs:
1013
label_issues:
1114
name: Add labels

‎.github/workflows/on_master.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,9 @@ concurrency:
1111
group: release
1212
cancel-in-progress: false
1313

14+
permissions:
15+
contents: read
16+
1417
jobs:
1518
doc_checks:
1619
name: Doc checks
@@ -21,6 +24,10 @@ jobs:
2124
if: startsWith(github.event.head_commit.message, 'docs')
2225
name: Doc release
2326
needs: [doc_checks]
27+
permissions:
28+
contents: write
29+
pages: write
30+
id-token: write
2431
uses: ./.github/workflows/_release_docs.yaml
2532
with:
2633
# Use the same ref as the one that triggered the workflow.
@@ -64,6 +71,8 @@ jobs:
6471
changelog_update:
6572
name: Changelog update
6673
needs: [release_prepare]
74+
permissions:
75+
contents: write
6776
uses: apify/workflows/.github/workflows/python_bump_and_update_changelog.yaml@main
6877
with:
6978
version_number: ${{ needs.release_prepare.outputs.version_number }}
@@ -95,6 +104,10 @@ jobs:
95104
doc_release_post_publish:
96105
name: Doc release post publish
97106
needs: [changelog_update, pypi_publish]
107+
permissions:
108+
contents: write
109+
pages: write
110+
id-token: write
98111
uses: ./.github/workflows/_release_docs.yaml
99112
with:
100113
# Use the ref from the changelog update to include the updated changelog.

‎.github/workflows/on_pull_request.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,10 @@ on:
44
# Runs whenever a pull request is opened or updated.
55
pull_request:
66

7+
permissions:
8+
contents: read
9+
pull-requests: read
10+
711
jobs:
812
pr_title_check:
913
name: PR title check

‎.github/workflows/on_schedule_tests.yaml‎

Lines changed: 3 additions & 0 deletions

0 commit comments

Comments
 (0)