bikash-barnwal opened a new pull request, #43197: URL: https://github.com/apache/superset/pull/43197
### SUMMARY 16 of the 47 workflows in `.github/workflows/` had no top-level `permissions:` block, so their `GITHUB_TOKEN` scope came from whatever the repository or organisation default grants — broader than any of these jobs needs, and invisible to anyone reading the workflow or reviewing a diff. Each now declares `permissions: contents: read`, placed exactly where the other 31 workflows put it (after `env:`, before `jobs:`). **This changes no effective privilege**, which is worth stating precisely since a restrictive top-level block *can* break a workflow that silently relied on default write: - every job in all 16 files already declares its own `permissions:` block — audited by parsing the YAML, not by eyeballing; - a job-level block **replaces** the top-level one rather than merging, so each job keeps exactly the scope it declares; - none of the 16 are reusable-workflow callers (`jobs.<id>.uses`), which inherit differently. So the win is reviewability and defence in depth: any job added later without its own block now starts read-only instead of inheriting the org default. Files: `bump-python-package`, `check-db-migration-confict`, `codeql-analysis`, `enforce-single-migration-head`, `issue-creation`, `labeler`, `latest-release-tag`, `pr-lint`, `showtime-cleanup`, `showtime-trigger`, `superset-e2e`, `superset-helm-release`, `superset-playwright`, `superset-python-presto-hive`, `supersetbot`, `welcome-new-users`. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF Not applicable — CI configuration. ### TESTING INSTRUCTIONS ```bash npm install -g @action-validator/[email protected] @action-validator/[email protected] for f in $(git diff --name-only origin/master); do action-validator "$f"; done ``` All 16 pass with **0 failures**, matching what `.github/workflows/github-action-validator.sh` runs in CI. Separately, all 47 workflows were parsed to confirm each now has a top-level `permissions` key and none broke. The change is additive: 48 insertions, 0 deletions, 3 lines per file. ### ADDITIONAL INFORMATION - [x] Has associated issue: Fixes #42986 - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [ ] Introduces new feature or API - [ ] Removes existing feature or API 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
