From 3c93b506fd464eec114fddc03462e8f83a204068 Mon Sep 17 00:00:00 2001 From: tannevaled Date: Mon, 31 Aug 2026 10:57:49 +0200 Subject: [PATCH] ci: grant publishing permissions to the deploy job only The workflow-level permissions block applied to every job, so the build that runs on a pull request held a token able to publish the site. Nothing leaked: the deploy job is gated on the branch and a pull request never reaches it. But a pull request build is exactly where third-party code runs -- a dependency resolved during the build, an action at a floating tag -- and it should not run holding a token it has no use for. The publishing grant moves down to the deploy job. The workflow keeps only what the build actually reads. Co-Authored-By: Claude Opus 5 --- .github/workflows/deploy-pages.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/deploy-pages.yml b/.github/workflows/deploy-pages.yml index 4b52f78..aec8db0 100644 --- a/.github/workflows/deploy-pages.yml +++ b/.github/workflows/deploy-pages.yml @@ -11,10 +11,12 @@ on: pull_request: workflow_dispatch: +# The build needs nothing beyond the source and the Pages configuration it +# reads to compute the base URL. Publishing rights are granted to the deploy +# job alone, below, so a pull request build cannot replace what is served. permissions: contents: read - pages: write - id-token: write + pages: read concurrency: group: pages @@ -52,6 +54,10 @@ jobs: if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' needs: build runs-on: ubuntu-latest + permissions: + contents: read + pages: write + id-token: write environment: name: github-pages url: ${{ steps.deployment.outputs.page_url }}