ci(security): least-privilege token permissions (Scorecard)#412
Merged
Conversation
…issions) Set top-level `permissions: contents: read` and grant writes per-job only where needed, across the workflows Scorecard flagged for top-level/over-broad write: - codeql.yml: security-events:write → analyze job only. - blocklist-refresh.yml: contents/pull-requests:write → refresh job only. - image-cache-publish.yml: drop unused actions:write; packages:write → publish-images job only. - release.yml: contents:write → create-release job only. - release-internal.yml + release-public-interim.yml: per-job matrix — packages:write on image push/merge jobs, id-token+attestations:write on attest/cosign jobs, contents:write on the release job; everything else contents:read. ci.yml's job-level actions:write is kept (required + documented: docker buildx GHA cache backend). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
Formalizes the triaged, accepted advisories (4 unmaintained/no-patch Rust crates + js-yaml DoS with no upstream fix) in osv-scanner.toml with per-item rationale, mirroring deny.toml. Adds docs/security/supply-chain-posture.md documenting how each OpenSSF Scorecard finding is addressed or deliberately accepted (vendored wheels = intentional hermetic builds; base-image tags = intentional for OS-patch freshness). Part of #410. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Three related changes toward a clean public release: 1. Stop the amd64-only `:latest` clobber. image-cache-publish.yml (CI build cache, host-arch/amd64-only) was pushing `:latest` on every main push, overwriting the multi-arch `:latest` the release workflow publishes — so `kars dev --release` (default :latest) got amd64-only controller/router and broke on arm64/kind. The cache workflow now pushes only sha-/branch tags; `:latest` is owned solely by the release workflow. 2. Rebrand the release workflow from "interim" to a general public release: trigger on clean `vX.Y.Z` tags too (not just `-interim`), conditional release name, drop the ESRP/"reserved for npmjs/MCR" language from the notes + manifest. The release body now leads with signing/SBOM/provenance and a one-line "crates.io/npmjs/MCR in progress" note. 3. README: replace the "Microsoft-signed packages coming soon / build from source" caveat with an accurate "every published artefact is cosign-signed + SBOM + SLSA-attested" statement (the no-compile path works today). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Dry-run by default; APPLY=1 deletes CI build-cache tags (sha-<commit>, main), per-arch build intermediates (*-amd64/*-arm64), and optionally old interim release tags — keeping `latest`, clean vX.Y.Z release tags, and cosign signatures. Needs a token with delete:packages (GitHub has no API for this under the default workflow token). Part of the package audit (#410). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
`kars dev --target local-k8s` has no --once option (runLocalK8s brings the cluster up and returns on its own), so the flag made the kind harness fail immediately with "unknown option '--once'". Remove it. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- install.sh is now a 40-line PUBLIC, no-auth installer: resolves the latest
signed GitHub Release and `npm i -g`s it. So the install is one short line:
curl -fsSL https://raw.githubusercontent.com/Azure/kars/main/install.sh | bash
KARS_VERSION pins a release. (Replaces the old internal/auth-gated installer.)
- Release workflow: publish @kars/cli to npmjs with `npm publish --provenance`
on clean (non-interim) release tags, gated on an NPM_TOKEN secret (no-ops
until configured). Once live, install shortens to `npm i -g @kars/cli`.
- README "Try it in five minutes" rewritten: two-command quickstart + one
collapsible "Other ways to install"; dropped the verbose build-from-source
and now-obsolete internal-channel blocks.
- cleanup-ghcr-tags.sh: robust rewrite (gh --paginate --jq, preflight scope
check) — fixes the jq/pagination crash.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This was referenced Jun 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sets top-level
permissions: contents: read+ per-job writes across the workflows Scorecard flagged for over-broad top-level write (codeql, blocklist-refresh, image-cache-publish, release, release-internal, release-public-interim). Verified by cutting v0.1.0-interim.11 from this branch — a full release run exercises every per-job permission (image push, cosign/attest, release creation). Part of #410.