Skip to content

Commit cb2cd8a

Browse files
committed
Fix zizmor excessive-permissions warning in backport workflow
Move permissions from workflow level to job level to follow the principle of least privilege. This resolves the zizmor excessive-permissions finding without changing the effective permissions of either job.
1 parent 0671193 commit cb2cd8a

1 file changed

Lines changed: 7 additions & 3 deletions

File tree

.github/workflows/backport.yaml

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,14 @@ on:
66
types:
77
- closed
88
- labeled
9-
permissions:
10-
contents: read
11-
pull-requests: write
9+
permissions: {}
1210

1311
jobs:
1412
backport_v1_0:
1513
name: "Backport to v1.0"
14+
permissions:
15+
contents: read
16+
pull-requests: write
1617
# Only react to merged PRs for security reasons.
1718
# See https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target.
1819
if: >
@@ -72,6 +73,9 @@ jobs:
7273
7374
backport_v2_0:
7475
name: "Backport to v2.0"
76+
permissions:
77+
contents: read
78+
pull-requests: write
7579
# Only react to merged PRs for security reasons.
7680
# See https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target.
7781
if: >

0 commit comments

Comments
 (0)