From 0081a626ecf5471e3506153419684249ee73fc97 Mon Sep 17 00:00:00 2001 From: Albert Mavashev Date: Sat, 2 May 2026 16:45:35 -0400 Subject: [PATCH] ops: tighten workflow token permissions Same pattern as runcycles/cycles-server#144. Addresses Token-Permissions criterion from OpenSSF Scorecard. --- .github/workflows/dependabot-auto-merge.yml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 9569b47..6ad171c 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -2,14 +2,18 @@ name: Dependabot auto-merge on: pull_request -permissions: - contents: write - pull-requests: write +# Default to read-all at top level; the automerge job below escalates only the +# narrow scopes it actually needs. Per OpenSSF Scorecard's Token-Permissions +# criterion: avoid blanket write at the workflow level. +permissions: read-all jobs: automerge: runs-on: ubuntu-latest if: github.event.pull_request.user.login == 'dependabot[bot]' + permissions: + contents: write # required to enable auto-merge + pull-requests: write # required to mark the PR as auto-merge steps: - name: Fetch Dependabot metadata id: meta