bikash-barnwal opened a new pull request, #43197:
URL: https://github.com/apache/superset/pull/43197

   ### SUMMARY
   
   16 of the 47 workflows in `.github/workflows/` had no top-level 
`permissions:` block, so their `GITHUB_TOKEN` scope came from whatever the 
repository or organisation default grants — broader than any of these jobs 
needs, and invisible to anyone reading the workflow or reviewing a diff.
   
   Each now declares `permissions: contents: read`, placed exactly where the 
other 31 workflows put it (after `env:`, before `jobs:`).
   
   **This changes no effective privilege**, which is worth stating precisely 
since a restrictive top-level block *can* break a workflow that silently relied 
on default write:
   
   - every job in all 16 files already declares its own `permissions:` block — 
audited by parsing the YAML, not by eyeballing;
   - a job-level block **replaces** the top-level one rather than merging, so 
each job keeps exactly the scope it declares;
   - none of the 16 are reusable-workflow callers (`jobs.<id>.uses`), which 
inherit differently.
   
   So the win is reviewability and defence in depth: any job added later 
without its own block now starts read-only instead of inheriting the org 
default.
   
   Files: `bump-python-package`, `check-db-migration-confict`, 
`codeql-analysis`, `enforce-single-migration-head`, `issue-creation`, 
`labeler`, `latest-release-tag`, `pr-lint`, `showtime-cleanup`, 
`showtime-trigger`, `superset-e2e`, `superset-helm-release`, 
`superset-playwright`, `superset-python-presto-hive`, `supersetbot`, 
`welcome-new-users`.
   
   ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
   
   Not applicable — CI configuration.
   
   ### TESTING INSTRUCTIONS
   
   ```bash
   npm install -g @action-validator/[email protected] @action-validator/[email protected]
   for f in $(git diff --name-only origin/master); do action-validator "$f"; 
done
   ```
   
   All 16 pass with **0 failures**, matching what 
`.github/workflows/github-action-validator.sh` runs in CI. Separately, all 47 
workflows were parsed to confirm each now has a top-level `permissions` key and 
none broke.
   
   The change is additive: 48 insertions, 0 deletions, 3 lines per file.
   
   ### ADDITIONAL INFORMATION
   
   - [x] Has associated issue: Fixes #42986
   - [ ] Required feature flags:
   - [ ] Changes UI
   - [ ] Includes DB Migration (follow approval process in 
[SIP-59](https://github.com/apache/superset/issues/13351))
     - [ ] Migration is atomic, supports rollback & is backwards-compatible
     - [ ] Confirm DB migration upgrade and downgrade tested
     - [ ] Runtime estimates and downtime expectations provided
   - [ ] Introduces new feature or API
   - [ ] Removes existing feature or API
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to