From e1dfb7d8309210e7bd27798b28d569262e753eed Mon Sep 17 00:00:00 2001 From: Open Source Santander AI Date: Wed, 8 Jul 2026 12:28:51 +0200 Subject: [PATCH] security: scope CLA workflow token permissions to job level Top-level permissions set to none; the four scopes CLA Assistant Lite requires (actions, contents, pull-requests, statuses) are now granted only to the cla job. Same effective privilege today (single job), but future jobs no longer inherit write access and the workflow follows the least-privilege pattern recommended for pull_request_target. Same change already merged and verified live in gen-fraud-graph#24. No behavior change. --- .github/workflows/cla.yml | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index 27b87c2..097273d 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -16,17 +16,19 @@ on: pull_request_target: types: [opened, closed, synchronize] -# contents: write is required so the bot can commit the signature file back. -permissions: - actions: write - contents: write - pull-requests: write - statuses: write +# contents: write is required so the bot can commit the signature file back; +# all permissions are granted at job level only (top-level default: none). +permissions: {} jobs: cla: name: CLA Assistant runs-on: ubuntu-latest + permissions: + actions: write + contents: write + pull-requests: write + statuses: write if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target' steps: - name: CLA Assistant