Add least privilege permissions to GitHub Actions workflows #3826
+42
−0
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Set explicit `permissions: contents: read` on 14 workflow files to enforce the principle of least privilege. This reduces the attack surface by ensuring workflows only have the minimum permissions required for their tasks. Workflows updated: - clippy.yml, cross.yml, doc.yml, fmt.yml, gen.yml, lib.yml, linux.yml, miri.yml, msrv.yml, no-default-features.yml, no_std.yml, publish.yml, slim_errors.yml, test.yml web.yml is unchanged as it already has appropriate permissions for GitHub Pages deployment (contents: read, pages: write, id-token: write). Co-authored-by: kennykerr <9845234+kennykerr@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Update GitHub Actions workflows to set minimum permissions
Add least privilege permissions to GitHub Actions workflows
Dec 1, 2025
kennykerr
approved these changes
Dec 1, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What's this all about?
Adds explicit
permissions: contents: readto all workflow files that were missing permission declarations. This enforces least privilege by ensuring CI workflows only have read access to repository contents.Updated (14 files): clippy, cross, doc, fmt, gen, lib, linux, miri, msrv, no-default-features, no_std, publish, slim_errors, test
Unchanged:
web.ymlalready has appropriate permissions (contents: read,pages: write,id-token: write) for GitHub Pages deployment.Fixes: #3572
Original prompt
This pull request was created as a result of the following prompt from Copilot chat.
✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.