Skip to content

Fix/token permissions id 20260911 #51

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 9 commits into from
Sep 18, 2026
+4 −2
Merged

Fix/token permissions id 20260911 #51

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
ecb5936
fix(ci): switch to permissionless reusable workflow
hyperpolymath Jul 7, 2026
d9f3142
fix(ci): clear OSSF Scorecard startup_failure
Jul 7, 2026
752f626
fix: update CodeQL actions to SHA-pinned v3 (29b1f65c)
hyperpolymath Jul 26, 2026
5765ae5
fix(ci): update reusable workflow pins to @892497fe + remove excessiv…
hyperpolymath Aug 12, 2026
d51a10b
Merge remote-tracking branch 'origin/main' into fix/ci-timeout-minute…
hyperpolymath Aug 12, 2026
4de7aba
Merge branch 'main' of github.com:hyperpolymath/anytype into fix/ci-t…
hyperpolymath Aug 18, 2026
38d6fee
Merge remote-tracking branch 'origin/ci/fix-ossf-scorecard-startup' i…
hyperpolymath Aug 18, 2026
a57ec77
Fix TokenPermissionsID: apply least-privilege permissions
mistral-vibe Sep 11, 2026
dd76fb3
Merge branch 'main' into fix/token-permissions-id-20260911
hyperpolymath Sep 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/dependabot-automerge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# SPDX-License-Identifier: MPL-2.0

Check failure on line 1 in .github/workflows/dependabot-automerge.yml

View workflow job for this annotation

GitHub Actions / Hypatia neurosymbolic scan 

[hypatia] workflow .github/workflows/dependabot-automerge.yml performs a write (push/commit/release/PR) but grants no `contents: write` at the workflow level or any job level — the write will be denied at run time.
#
# dependabot-automerge.yml — enable GitHub's native auto-merge on
# Dependabot pull requests that match a declared severity / ecosystem
Expand Down Expand Up @@ -42,13 +42,13 @@
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: false
permissions:
contents: write # needed to enable auto-merge
contents: read # needed to enable auto-merge
pull-requests: write # needed to approve
# NB: keep narrow — do NOT add secrets: read or id-token: write here.
jobs:
automerge:
# Only run for PRs actually authored by Dependabot.
if: github.actor == 'dependabot[bot]' && github.event.pull_request.user.login == 'dependabot[bot]'

Check failure on line 51 in .github/workflows/dependabot-automerge.yml

View workflow job for this annotation

GitHub Actions / Hypatia neurosymbolic scan 

[hypatia] workflow .github/workflows/dependabot-automerge.yml:51 gates on `github.actor == 'dependabot[bot]'` — `github.actor` is the run-triggering user, which an attacker controls on `pull_request_target` from a fork
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
Expand All @@ -56,7 +56,7 @@
id: meta
uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
with:
github-token: ${{ secrets.GITHUB_TOKEN }}

Check warning on line 59 in .github/workflows/dependabot-automerge.yml

View workflow job for this annotation

GitHub Actions / Hypatia neurosymbolic scan 

[hypatia] job in .github/workflows/dependabot-automerge.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring
# --- Policy gate -------------------------------------------------------
# Outputs from fetch-metadata we care about:
# update-type → version-update:semver-{patch,minor,major}
Expand Down
4 changes: 3 additions & 1 deletion .github/workflows/secret-scanner.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,5 +17,7 @@ permissions:
# .github/workflows/README.adoc.
jobs:
scan:
uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd
permissions:
contents: read
uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@db12a6ad3ef9076d5f7bdcf98d7d15cf8547555a
secrets: inherit
Loading