Repository navigation
Specify default permissions for codeql-create-issues.yml #8580
Description
Prerequisites
- Be a member of Hack for LA. (There are no fees to join.) If you have not joined yet, please follow the steps on our Getting Started page and attend an onboarding session.
- You have already read our How to Contribute to Hack for LA Guide.
Overview
We need to update the default permissions for the GitHub workflow specified in codeql-create-issues.yml, so that it does not have more permissions than it needs.
Details
To align with GitHub security best practices, we want to specify the minimum required permissions for each workflow via a top-level permissions: block to ensure that workflows only have the access they need by default.
Every GitHub Actions workflow automatically receives a GITHUB_TOKEN with a set of default repository permissions defined in the repo settings which may result in the workflow having more permissions than it needs to complete its job. By explicitly defining minimum default permissions at the workflow level, we can ensure that workflow has only the permissions it needs. Then if a job or step requires more access, those permissions can be explicitly granted using job-level permissions statements or step-level tokens (PATs).
We performed an audit to identify the minimum top-level permissions required for each workflow. The goal of this and related issues is to verify that each workflow continues to function correctly with the explicitly defined permissions. This approach helps minimize unnecessary privileges and strengthen overall repository security.
For additional info, see issue #8178 and GitHub's recommendation for security best practice.
Action Items
Note that this issue involves testing GitHub Actions. See "Resources/Instructions" below for how to set up your personal environment for testing.
Refer to codeql-create-issues.yml:
- Review the file to understand how the workflow is triggered. This is specified near the top of the YML in the
on:section. - Near the top of the file immediately before the line
jobs:insert:permissions: contents: read security-events: read issues: read - Use clean formatting: make sure there is one line separation above and one below the permissions block.
- If the workflow includes line(s) similar to the following, you will need to change these to match your situation before the workflow will run correctly:
or
if: github.repository == 'hackforla/website'branches: - 'gh-pages' - Create the event to trigger the workflow and confirm whether it runs successfully with no further changes to the permissions.
- If there are errors:
- Try to determine the nature of the error, and whether it is occurring due to a mismatched repo or branch name.
- If you cannot track down the error, consult with the team via Slack or the weekly meetings to report your findings and get additional direction.
- If there are no errors, submit the PR like usual. Include a link to your test log.
Resources/Instructions
- Refer to The "Hack for LA's GitHub Actions" Wiki guide needs additional explanation #6537 (comment), especially Tips 6, 7, and 8, if you have not already created you personal environment for testing.
- How to Test GitHub Actions
- Additional Notes for GitHub Actions
- Tokens, Secrets, Scopes, & Permissions
Activity
HackforLABot commentedon May 27, 2026
Hi @castillios, thank you for taking up this issue! Hfla appreciates you :)
Do let fellow developers know about your:-
i. Availability: (When are you available to work on the issue/answer questions other programmers might have about your issue?)
ii. ETA: (When do you expect this issue to be completed?)
You're awesome!
P.S. - You may not take up another issue until this issue gets merged (or closed). Thanks again :)
castillios commentedon May 27, 2026
i. Availability: Weekdays before 7PM
ii. ETA: By Thursday 5/28 4PM
castillios commentedon May 27, 2026
I tried testing this workflow and noticed an error after implementing the
permissionsblock exactly as specified in the issue.Testing and Error Logs for CodeQL Create Issues Action
I wanted to point attention to this part of the error log:
The nested job 'analyze' is requesting 'actions: read, security-events: write', but is only allowed 'actions: none, security-events: read'.It seems there are conflicting permissions here? In
codeql-scan-job.yml(whichcodeql-create-issues.ymluses) the permissions are correctly set toactions: read, security-events: writein its ownpermissionsblock.However I believe the top level permissions block this issue specifies for
codeql-create-issues.yml, overrides those settings which would otherwise be needed. Regardless when I ran the tests for this workflow BEFORE making these changesactionsandsecurity-eventswere both set tononeby default.Should I update the top-level permissions block to the following? Or if there's another issue at play, keep it as is?
I used this google doc and this wiki article to set up my testing environment.
I'm still learning about GitHub Actions and would like some direction to resolving this issue. Thank you!
t-will-gillis commentedon May 28, 2026
Hi @castillios - yes, you are correct and can update the top-level permissions as shown, and in the PR you can note that you can state that the permissions were updated after we talked about it.
Thanks!
castillios commentedon May 28, 2026
Hi @t-will-gillis, thank you for checking in! I've implemented the changes and opened a PR.