From b398c2f183466a8f9e24055b0f8f9692486a9eb5 Mon Sep 17 00:00:00 2001 From: James Stocker Date: Tue, 2 Jun 2026 16:14:19 +0200 Subject: [PATCH] fix: resolve zizmor excessive-permissions + artipacked (INFRA-869) least-privilege permissions: contents: read on ci + release-sonatype (Sonatype publishing uses PGP/Sonatype creds, not GITHUB_TOKEN); persist-credentials: false on checkouts (no git pushes). Deferred (INFRA-869 cross-cutting decisions): unpinned-uses (pin-vs-wrap pending). Verified with the org zizmor config: 0 findings outside the deferred set. INFRA-869 --- .github/workflows/ci.yml | 4 ++++ .github/workflows/release-sonatype.yml | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 56131a7..cdba121 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -7,11 +7,15 @@ on: branches: - master workflow_dispatch: +permissions: + contents: read jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v6 + with: + persist-credentials: false - uses: actions/setup-java@v4 with: java-version: 11 diff --git a/.github/workflows/release-sonatype.yml b/.github/workflows/release-sonatype.yml index 8ffc59d..2de3d28 100644 --- a/.github/workflows/release-sonatype.yml +++ b/.github/workflows/release-sonatype.yml @@ -6,6 +6,9 @@ on: - 'v*' workflow_dispatch: +permissions: + contents: read + jobs: release-sonatype: runs-on: ubuntu-latest @@ -14,6 +17,7 @@ jobs: with: # We need to unshallow to allow git describe work with last tag fetch-depth: 0 + persist-credentials: false - uses: actions/setup-java@v4 with: java-version: 11