From 2dc22ea5f40b4478c5487bd52e2b5fde2bbb8101 Mon Sep 17 00:00:00 2001 From: Jan Calanog Date: Sun, 18 Feb 2024 02:33:50 +0700 Subject: [PATCH 1/3] security: add permissions block to workflows --- .github/workflows/opentelemetry.yml | 3 +++ .github/workflows/test-reporter.yml | 4 ++++ 2 files changed, 7 insertions(+) diff --git a/.github/workflows/opentelemetry.yml b/.github/workflows/opentelemetry.yml index 6a4dd89..009fe2c 100644 --- a/.github/workflows/opentelemetry.yml +++ b/.github/workflows/opentelemetry.yml @@ -9,6 +9,9 @@ on: - release types: [completed] +permissions: + contents: read + jobs: otel-export-trace: runs-on: ubuntu-latest diff --git a/.github/workflows/test-reporter.yml b/.github/workflows/test-reporter.yml index 39b10a0..075682a 100644 --- a/.github/workflows/test-reporter.yml +++ b/.github/workflows/test-reporter.yml @@ -8,6 +8,10 @@ on: types: - completed +permissions: + contents: read + actions: read + jobs: report: runs-on: ubuntu-latest From a02923484442d8f5100d655c733d490dca727b2c Mon Sep 17 00:00:00 2001 From: Miguel Allende Date: Wed, 8 Jul 2026 15:56:45 +0200 Subject: [PATCH 2/3] fix workflow permissions --- .github/workflows/test-reporter.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/test-reporter.yml b/.github/workflows/test-reporter.yml index 075682a..e7ce6e2 100644 --- a/.github/workflows/test-reporter.yml +++ b/.github/workflows/test-reporter.yml @@ -11,6 +11,7 @@ on: permissions: contents: read actions: read + checks: write jobs: report: From 9aad1924e576a090b0db43c600a8e2e416c6528f Mon Sep 17 00:00:00 2001 From: Miguel Allende Date: Thu, 9 Jul 2026 10:38:39 +0200 Subject: [PATCH 3/3] scope write permissions to jobs --- .github/workflows/test-reporter.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/test-reporter.yml b/.github/workflows/test-reporter.yml index e7ce6e2..443cbe2 100644 --- a/.github/workflows/test-reporter.yml +++ b/.github/workflows/test-reporter.yml @@ -11,10 +11,13 @@ on: permissions: contents: read actions: read - checks: write jobs: report: + permissions: + contents: read + actions: read + checks: write runs-on: ubuntu-latest steps: - uses: elastic/apm-pipeline-library/.github/actions/test-report@current