From 2392cbdab000a67e06041479f0e1eea5289782de Mon Sep 17 00:00:00 2001 From: Matthew Watkins Date: Tue, 1 Sep 2026 19:38:10 +0100 Subject: [PATCH] CI: Remove issues read permission from scan jobs The Grype scan jobs requested "issues: read" so the CVE bypass lookup could find maintainer-approved bypass issues. A called workflow cannot hold a permission its caller withheld, so every consumer that does not grant "issues: read" fails before it starts. GitHub reports that as a startup failure: zero jobs, no check runs and no annotation. The pull request then looks green because the checks that would fail never run. This estate publishes only public repositories, whose issues any client can read without a token or a scope. The bypass lookup also tolerates failure. It warns, returns an empty bypass list and exits zero, which leaves the vulnerability gate closed. Missing bypass data can only make a scan stricter, never weaker. Drop the request from the reusable workflows, along with the matching grants wherever this repository documents or exercises them, so that consumers no longer need to grant a permission that nothing requires. Co-authored-by: Claude Signed-off-by: Matthew Watkins --- .github/workflows/gradle-build-test.yaml | 1 - .github/workflows/maven-build-test.yaml | 1 - .github/workflows/testing.yaml | 2 -- examples/gradle/build-test/gerrit.yaml | 1 - examples/gradle/build-test/github.yaml | 1 - examples/maven/build-test/gerrit.yaml | 1 - examples/maven/build-test/github.yaml | 1 - 7 files changed, 8 deletions(-) diff --git a/.github/workflows/gradle-build-test.yaml b/.github/workflows/gradle-build-test.yaml index 412559b..e63f98d 100644 --- a/.github/workflows/gradle-build-test.yaml +++ b/.github/workflows/gradle-build-test.yaml @@ -632,7 +632,6 @@ jobs: timeout-minutes: ${{ inputs.grype_timeout_minutes }} permissions: contents: read - issues: read # Read maintainer-approved CVE bypass issues steps: # One harden-runner step with the policy computed, rather than # two selected by condition: harden-runner declares a 'pre' diff --git a/.github/workflows/maven-build-test.yaml b/.github/workflows/maven-build-test.yaml index 7d675fb..dee05d0 100644 --- a/.github/workflows/maven-build-test.yaml +++ b/.github/workflows/maven-build-test.yaml @@ -698,7 +698,6 @@ jobs: timeout-minutes: ${{ inputs.grype_timeout_minutes }} permissions: contents: read - issues: read # Read maintainer-approved CVE bypass issues steps: # One harden-runner step with the policy computed, rather than # two selected by condition: harden-runner declares a 'pre' diff --git a/.github/workflows/testing.yaml b/.github/workflows/testing.yaml index a680bc0..ef90fad 100644 --- a/.github/workflows/testing.yaml +++ b/.github/workflows/testing.yaml @@ -47,7 +47,6 @@ jobs: permissions: contents: read pull-requests: read # repository-metadata-action queries PR data - issues: read # Grype scan reads approved CVE bypass issues uses: ./.github/workflows/maven-build-test.yaml with: repository: 'apache/maven' @@ -63,7 +62,6 @@ jobs: permissions: contents: read pull-requests: read # repository-metadata-action queries PR data - issues: read # Grype scan reads approved CVE bypass issues uses: ./.github/workflows/gradle-build-test.yaml with: repository: 'onap/portal-ng-preferences' diff --git a/examples/gradle/build-test/gerrit.yaml b/examples/gradle/build-test/gerrit.yaml index 3adc13e..c718f86 100644 --- a/examples/gradle/build-test/gerrit.yaml +++ b/examples/gradle/build-test/gerrit.yaml @@ -126,7 +126,6 @@ jobs: permissions: contents: read pull-requests: read # repository-metadata-action queries PR data - issues: read # Grype scan reads approved CVE bypass issues # REPLACE the pinned SHA below with a java-workflows release SHA # (or your instantiated workflows repository's release SHA). # The all-zero SHA is a non-functional placeholder, NOT a real commit. diff --git a/examples/gradle/build-test/github.yaml b/examples/gradle/build-test/github.yaml index d341461..205d0ec 100644 --- a/examples/gradle/build-test/github.yaml +++ b/examples/gradle/build-test/github.yaml @@ -36,7 +36,6 @@ jobs: permissions: contents: read pull-requests: read # repository-metadata-action queries PR data - issues: read # Grype scan reads approved CVE bypass issues # REPLACE the pinned SHA below with a java-workflows release SHA # (or your instantiated workflows repository's release SHA). # The all-zero SHA is a non-functional placeholder, NOT a real commit. diff --git a/examples/maven/build-test/gerrit.yaml b/examples/maven/build-test/gerrit.yaml index 5d8f745..3dd1d03 100644 --- a/examples/maven/build-test/gerrit.yaml +++ b/examples/maven/build-test/gerrit.yaml @@ -126,7 +126,6 @@ jobs: permissions: contents: read pull-requests: read # repository-metadata-action queries PR data - issues: read # Grype scan reads approved CVE bypass issues # REPLACE the pinned SHA below with a java-workflows release SHA # (or your instantiated workflows repository's release SHA). # The all-zero SHA is a non-functional placeholder, NOT a real commit. diff --git a/examples/maven/build-test/github.yaml b/examples/maven/build-test/github.yaml index 9de0a65..91659fe 100644 --- a/examples/maven/build-test/github.yaml +++ b/examples/maven/build-test/github.yaml @@ -36,7 +36,6 @@ jobs: permissions: contents: read pull-requests: read # repository-metadata-action queries PR data - issues: read # Grype scan reads approved CVE bypass issues # REPLACE the pinned SHA below with a java-workflows release SHA # (or your instantiated workflows repository's release SHA). # The all-zero SHA is a non-functional placeholder, NOT a real commit.