jethac opened a new issue, #42986: URL: https://github.com/apache/superset/issues/42986
### Problem 15 of the 45 workflows in `.github/workflows/` have no top-level `permissions:` block, including: ``` bump-python-package.yml check-db-migration-confict.yml codeql-analysis.yml issue-creation.yml labeler.yml latest-release-tag.yml pr-lint.yml showtime-cleanup.yml ``` Without one, each job gets whatever the repository or organisation default grants, which is broader than any of these jobs needs and is not visible in the workflow file. A reviewer reading the workflow cannot tell what token scope it runs with. ### Proposed change Set `permissions: contents: read` at the top of each workflow and opt in per job where more is genuinely needed — the pattern most of the other 30 workflows already follow. It is a mechanical change and it makes the privilege each workflow holds reviewable in the diff. Verified against `master` at `3539c41dab`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
