Skip to content

ci: add least-privilege permissions to GitHub Actions workflows - #122

Merged
peter-matkovski merged 14 commits into
mainfrom
ci/workflow-least-privilege-permissions
Aug 25, 2026
Merged

ci: add least-privilege permissions to GitHub Actions workflows#122
peter-matkovski merged 14 commits into
mainfrom
ci/workflow-least-privilege-permissions

Conversation

@peter-matkovski

@peter-matkovski peter-matkovski commented Jul 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

  • Add explicit least-privilege permissions blocks to workflow files flagged by CodeQL.
  • Scopes derived from workflow operations (build, artifacts, Danger, release git push).
  • Resolves 6 open actions/missing-workflow-permissions alerts.

Linear

Test plan

  • CI green
  • Code scanning alerts close after merge

@peter-matkovski
CI: add least-privilege permissions to GitHub Actions workflows
5efdc71 
Add explicit workflow-level permissions blocks to resolve CodeQL
actions/missing-workflow-permissions alerts. Scopes are derived from
workflow operations (git push, artifact upload, Danger, release lanes).

Refs: APPSEC-164
@peter-matkovski
CI: add least-privilege permissions to GitHub Actions workflows
7e8f6de 
Add explicit workflow-level permissions blocks to resolve CodeQL
actions/missing-workflow-permissions alerts. Scopes are derived from
workflow operations (git push, artifact upload, Danger, release lanes).

Refs: APPSEC-164
@peter-matkovski
CI: add least-privilege permissions to GitHub Actions workflows
4036591 
Add explicit workflow-level permissions blocks to resolve CodeQL
actions/missing-workflow-permissions alerts. Scopes are derived from
workflow operations (git push, artifact upload, Danger, release lanes).

Refs: APPSEC-164
@peter-matkovski
CI: add least-privilege permissions to GitHub Actions workflows
dcdbae4 
Add explicit workflow-level permissions blocks to resolve CodeQL
actions/missing-workflow-permissions alerts. Scopes are derived from
workflow operations (git push, artifact upload, Danger, release lanes).

Refs: APPSEC-164
@peter-matkovski
CI: add least-privilege permissions to GitHub Actions workflows
faebed6 
Add explicit workflow-level permissions blocks to resolve CodeQL
actions/missing-workflow-permissions alerts. Scopes are derived from
workflow operations (git push, artifact upload, Danger, release lanes).

Refs: APPSEC-164
@peter-matkovski
CI: add least-privilege permissions to GitHub Actions workflows
f8af012 
Add explicit workflow-level permissions blocks to resolve CodeQL
actions/missing-workflow-permissions alerts. Scopes are derived from
workflow operations (git push, artifact upload, Danger, release lanes).

Refs: APPSEC-164
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 8, 2026 11:27 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 8, 2026 11:27 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 8, 2026 11:27 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 8, 2026 11:27 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 8, 2026 11:27 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 8, 2026 11:27 — with GitHub Actions Inactive
@peter-matkovski peter-matkovski self-assigned this Jul 8, 2026
@peter-matkovski
peter-matkovski requested a review from a team July 9, 2026 09:37
@peter-matkovski
peter-matkovski enabled auto-merge (squash) July 9, 2026 11:41
mogita
mogita reviewed Jul 9, 2026
View reviewed changes
Comment thread .github/workflows/release.yml Outdated
Comment thread .github/workflows/reviewdog.yml Outdated
Comment thread .github/workflows/scheduled_test.yml Outdated
@peter-matkovski @mogita
Update .github/workflows/scheduled_test.yml
397f3bc 
Co-authored-by: 🌵 Yun Wang <yun.wang@getstream.io>
@peter-matkovski @mogita
Update .github/workflows/release.yml
8d3a02c 
Co-authored-by: 🌵 Yun Wang <yun.wang@getstream.io>
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 13, 2026 09:47 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 13, 2026 09:47 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 13, 2026 09:47 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 13, 2026 09:47 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 14, 2026 11:54 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 14, 2026 11:54 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 14, 2026 11:54 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 14, 2026 11:54 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 27, 2026 11:42 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 27, 2026 11:42 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 27, 2026 11:42 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 27, 2026 11:42 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 27, 2026 11:42 — with GitHub Actions Inactive
@peter-matkovski
peter-matkovski temporarily deployed to feeds-enabled-shard July 27, 2026 11:42 — with GitHub Actions Inactive
@peter-matkovski
Merge remote-tracking branch 'origin/main' into ci/workflow-least-pri…
a7fc72d 
…vilege-permissions

# Conflicts:
#	.github/workflows/initiate_release.yml
@peter-matkovski
peter-matkovski deployed to feeds-enabled-shard August 24, 2026 13:35 — with GitHub Actions Active
@peter-matkovski
peter-matkovski deployed to feeds-enabled-shard August 24, 2026 13:35 — with GitHub Actions Active
@peter-matkovski
peter-matkovski deployed to feeds-enabled-shard August 24, 2026 13:35 — with GitHub Actions Active
@peter-matkovski
peter-matkovski deployed to feeds-enabled-shard August 25, 2026 07:25 — with GitHub Actions Active
@peter-matkovski
peter-matkovski deployed to feeds-enabled-shard August 25, 2026 07:25 — with GitHub Actions Active
@peter-matkovski
peter-matkovski deployed to feeds-enabled-shard August 25, 2026 07:25 — with GitHub Actions Active
@peter-matkovski
peter-matkovski deployed to feeds-enabled-shard August 25, 2026 07:25 — with GitHub Actions Active
@peter-matkovski
peter-matkovski deployed to feeds-enabled-shard August 25, 2026 07:25 — with GitHub Actions Active
@peter-matkovski
peter-matkovski deployed to feeds-enabled-shard August 25, 2026 07:25 — with GitHub Actions Active
@peter-matkovski peter-matkovski changed the title CI: add least-privilege permissions to GitHub Actions workflows ci: add least-privilege permissions to GitHub Actions workflows Aug 25, 2026
@peter-matkovski
peter-matkovski merged commit c41b749 into main Aug 25, 2026
12 of 13 checks passed
@peter-matkovski
peter-matkovski deleted the ci/workflow-least-privilege-permissions branch August 25, 2026 07:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tbarbugli tbarbugli tbarbugli approved these changes
@mogita mogita mogita approved these changes

Assignees

@peter-matkovski peter-matkovski

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@peter-matkovski @tbarbugli @mogita