ci: add explicit permissions to all GitHub Actions workflows (cypress-io#1763)

mschile · web-flow · commit 1b6f360f667e · 2026-05-15T14:45:58.000-06:00
diff --git a/.github/workflows/add-issue-to-triage-board.yml b/.github/workflows/add-issue-to-triage-board.yml
@@ -6,6 +6,7 @@ on:
   pull_request_target:
     types:
       - opened
+permissions: {}
 jobs:
   add-to-triage-project-board:
     # skip in fork
diff --git a/.github/workflows/check-dist.yml b/.github/workflows/check-dist.yml
@@ -11,6 +11,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   check-dist:
diff --git a/.github/workflows/check-markdown.yml b/.github/workflows/check-markdown.yml
@@ -5,6 +5,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   check-markdown:
diff --git a/.github/workflows/example-basic-pnpm.yml b/.github/workflows/example-basic-pnpm.yml
@@ -5,6 +5,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   basic-pnpm:
diff --git a/.github/workflows/example-basic.yml b/.github/workflows/example-basic.yml
@@ -12,6 +12,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   basic:
diff --git a/.github/workflows/example-build-artifacts.yml b/.github/workflows/example-build-artifacts.yml
@@ -18,6 +18,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   build:
diff --git a/.github/workflows/example-chrome-for-testing.yml b/.github/workflows/example-chrome-for-testing.yml
@@ -5,6 +5,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   tests:
diff --git a/.github/workflows/example-chrome.yml b/.github/workflows/example-chrome.yml
@@ -10,6 +10,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   tests:
diff --git a/.github/workflows/example-component-test.yml b/.github/workflows/example-component-test.yml
@@ -5,6 +5,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   cypress-run:
diff --git a/.github/workflows/example-config.yml b/.github/workflows/example-config.yml
@@ -10,6 +10,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   start:
diff --git a/.github/workflows/example-cron.yml b/.github/workflows/example-cron.yml
@@ -4,6 +4,8 @@ on:
     # runs tests every day at 4am
     - cron: '0 4 * * *'
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   nightly:
diff --git a/.github/workflows/example-custom-ci-build-id.yml b/.github/workflows/example-custom-ci-build-id.yml
@@ -35,6 +35,9 @@ env:
   CYPRESS_PROJECT_ID: ${{ secrets.EXAMPLE_PROJECT_ID }}
   CYPRESS_RECORD_KEY: ${{ secrets.EXAMPLE_RECORDING_KEY }}
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+permissions:
+  contents: read
+  actions: read
 
 jobs:
   check-record-key:
diff --git a/.github/workflows/example-custom-command.yml b/.github/workflows/example-custom-command.yml
@@ -10,6 +10,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   start:
diff --git a/.github/workflows/example-debug.yml b/.github/workflows/example-debug.yml
@@ -14,6 +14,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   action-debug:
diff --git a/.github/workflows/example-docker.yml b/.github/workflows/example-docker.yml
@@ -5,6 +5,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   docker-browsers:
diff --git a/.github/workflows/example-edge.yml b/.github/workflows/example-edge.yml
@@ -5,6 +5,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   tests:
diff --git a/.github/workflows/example-env.yml b/.github/workflows/example-env.yml
@@ -17,6 +17,9 @@ env:
   # Cypress.env('environmentName') // 'staging'
   # see https://on.cypress.io/env
   CYPRESS_environmentName: staging
+permissions:
+  contents: read
+
 jobs:
   e2e:
     runs-on: ubuntu-24.04
diff --git a/.github/workflows/example-expose.yml b/.github/workflows/example-expose.yml
@@ -10,6 +10,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   with-expose:
diff --git a/.github/workflows/example-firefox.yml b/.github/workflows/example-firefox.yml
@@ -5,6 +5,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   firefox:
diff --git a/.github/workflows/example-install-command.yml b/.github/workflows/example-install-command.yml
@@ -5,6 +5,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   install-command:
diff --git a/.github/workflows/example-install-only.yml b/.github/workflows/example-install-only.yml
@@ -5,6 +5,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   # do not install every dependency in this example
diff --git a/.github/workflows/example-node-versions.yml b/.github/workflows/example-node-versions.yml
@@ -5,6 +5,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   cypress-run:
diff --git a/.github/workflows/example-quiet.yml b/.github/workflows/example-quiet.yml
@@ -5,6 +5,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   cypress-run:
diff --git a/.github/workflows/example-recording.yml b/.github/workflows/example-recording.yml
@@ -23,6 +23,9 @@ env:
   CYPRESS_PROJECT_ID: ${{ secrets.EXAMPLE_PROJECT_ID }}
   CYPRESS_RECORD_KEY: ${{ secrets.EXAMPLE_RECORDING_KEY }}
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+permissions:
+  contents: read
+  actions: read
 
 jobs:
   check-record-key:
diff --git a/.github/workflows/example-start-and-pnpm-workspaces.yml b/.github/workflows/example-start-and-pnpm-workspaces.yml
@@ -10,6 +10,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   # The example has pnpm workspaces in its "root" folder
diff --git a/.github/workflows/example-start-and-yarn-workspaces.yml b/.github/workflows/example-start-and-yarn-workspaces.yml
@@ -10,6 +10,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   single:
diff --git a/.github/workflows/example-start.yml b/.github/workflows/example-start.yml
@@ -16,6 +16,8 @@ env:
   # works around issue when more than one instance of serve is started
   # See PR https://github.com/vercel/serve/pull/457
   NO_UPDATE_CHECK: 1
+permissions:
+  contents: read
 
 jobs:
   start:
diff --git a/.github/workflows/example-wait-on.yml b/.github/workflows/example-wait-on.yml
@@ -10,6 +10,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   wait:
diff --git a/.github/workflows/example-webpack.yml b/.github/workflows/example-webpack.yml
@@ -5,6 +5,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   wait:
diff --git a/.github/workflows/example-yarn-classic.yml b/.github/workflows/example-yarn-classic.yml
@@ -10,6 +10,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   yarn-classic:
diff --git a/.github/workflows/example-yarn-modern-pnp.yml b/.github/workflows/example-yarn-modern-pnp.yml
@@ -5,6 +5,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   yarn-modern-pnp:
diff --git a/.github/workflows/example-yarn-modern.yml b/.github/workflows/example-yarn-modern.yml
@@ -5,6 +5,8 @@ on:
       - 'master'
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   yarn-modern:
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -4,6 +4,8 @@ on:
     branches:
       - 'master'
   pull_request:
+permissions:
+  contents: read
 jobs:
   build-and-test:
     runs-on: ubuntu-24.04
@@ -28,6 +30,10 @@ jobs:
       - run: npm run format:all:check # Prettier formatting check
 
   release:
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
     runs-on: ubuntu-24.04
     name: release
     needs: [build-and-test]
diff --git a/.github/workflows/triage_closed_issue_comment.yml b/.github/workflows/triage_closed_issue_comment.yml
@@ -3,6 +3,7 @@ on:
   issue_comment:
     types:
       - created
+permissions: {}
 jobs:
   closed-issue-comment:
     # skip in fork
