fix: scope id-token:write to only AWS OIDC deploy jobs#706
Merged
Conversation
The workflow-level permissions block granted id-token:write to every job, including detect-changes which only reads git diffs. Move the OIDC capability to only deploy-marketing and deploy-portal (which need it for aws-actions/configure-aws-credentials). deploy-paste uses a Cloudflare API token and doesn't need OIDC at all.
There was a problem hiding this comment.
Pull request overview
This PR reduces GitHub Actions OIDC exposure by removing id-token: write from the workflow-level permissions and granting it only to the specific deploy jobs that require AWS OIDC authentication. This aligns the deploy workflow with least-privilege principles and limits the blast radius of any future workflow compromise.
Changes:
- Removed workflow-wide
id-token: writepermission. - Added job-level
permissionswithid-token: writeonly for the AWS OIDC deploy jobs (deploy-marketing,deploy-portal). - Explicitly scoped
deploy-pastetocontents: readonly.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
id-token: writefrom the workflow-levelpermissionsblock indeploy.ymlpermissionswithid-token: writeonly todeploy-marketinganddeploy-portal(the two jobs that useaws-actions/configure-aws-credentialswith OIDC)deploy-pastegets onlycontents: readsince it authenticates viaCLOUDFLARE_API_TOKENdetect-changesinherits onlycontents: read— it just reads git diffs and has no need for OIDC mintingMotivated by the TanStack supply chain attack (TanStack/router#7383) which used GitHub Actions cache poisoning + OIDC trusted publishing. Our pipelines don't use
actions/cacheand aren't vulnerable, but least-privilege on OIDC is good hygiene.Test plan
workflow_dispatchtargeting marketing — confirm AWS OIDC auth succeedsdetect-changesjob still works withoutid-token: write