Harden Claude release workflow security#1130
Conversation
leighmcculloch
temporarily deployed
to
Receiver Registration - E2E Integration Tests (Stellar)
GitHub Actions
Inactive
leighmcculloch
temporarily deployed
to
Internal SEP Tests
GitHub Actions
Inactive
There was a problem hiding this comment.
Pull request overview
This PR hardens the automated_release_process GitHub Actions workflow by removing broad default GITHUB_TOKEN permissions at the workflow level and scoping them to the specific job that requires write access. This reduces risk if additional jobs are added later, by ensuring they inherit no token permissions unless explicitly granted.
Changes:
- Set workflow-level
permissions: {}to revoke all defaultGITHUB_TOKENscopes for the workflow. - Add job-level
permissionstocreate-releaseto retain required write capabilities (contents, PRs, issues, OIDC).
|
stellar-disbursement-platform-backend-preview is available here: |
marwen-abid
left a comment
marwen-abid
left a comment
There was a problem hiding this comment.
LGTM! Thank you for this 🙏
What
Apply a best practice to the
automated_release_processworkflow:contents: write/pull-requests: write/issues: write/id-token: writescope from workflow level to the single job that needs it; set top-levelpermissions: {}so any future job added to this file inherits nothing by default.Why
This is pretty minor, but brings this workflow in line with the Claude-action security standards being applied across the stellar org (see
stellar/stellar-corePR #5258 and the claude-code-action security guide). Withoutpermissions: {}at the workflow root, any future job added to this file would silently inherit the broad write scopes. Moving them to the job level limits the blast radius if this workflow expands in the future.