Security hardening: add explicit permissions: {contents: read} to both workflows #273

New issue

Closed

opened 2026-07-19 03:50:36 +00:00 by hexajon · 1 comment

hexajon commented

2026-07-19 03:50:36 +00:00

(Migrated from codeberg.org)

Neither .forgejo/workflows/ci.yml nor drift.yml declares a permissions: block (verified: no permissions: key in either file). The forge injects an auto Actions token whose fork-PR scope is forge/version-dependent and is readable by any code running in the job.

For a public repo the expected default is read-only, so impact is low, but making the grant explicit is cheap defense-in-depth and removes the dependency on the forge's default staying read-only across upgrades.

Fix: add a top-level permissions: {contents: read} to both workflows (tighten further per-job if any job needs less).

Acceptance: both workflows declare an explicit minimal permissions: block; CI still passes.

Neither `.forgejo/workflows/ci.yml` nor `drift.yml` declares a `permissions:` block (verified: no `permissions:` key in either file). The forge injects an auto Actions token whose fork-PR scope is forge/version-dependent and is readable by any code running in the job. For a public repo the expected default is read-only, so impact is low, but making the grant explicit is cheap defense-in-depth and removes the dependency on the forge's default staying read-only across upgrades. Fix: add a top-level `permissions: {contents: read}` to both workflows (tighten further per-job if any job needs less). Acceptance: both workflows declare an explicit minimal `permissions:` block; CI still passes.

hexajon commented

2026-07-20 19:40:28 +00:00

(Migrated from codeberg.org)

Follow-up: the fix landed in 4888f3b1 but had to be reverted in #306 - Forgejo does not support the workflow permissions: field at all; every run warned "not supported in Forgejo and will be ignored. Use Authorized Integrations to grant capabilities to this job instead."

Forgejo's model is inverted from GitHub's (Authorized Integrations docs): the automatic Actions token starts with limited capabilities, and Authorized Integrations (repo Settings) extend it for jobs that need more - there is no workflow-side knob to restrict below the default, so this issue's mitigation ("remove the dependency on the forge's default staying read-only") has no Forgejo equivalent.

No follow-up work needed for these workflows: neither uses the injected token at all (checkouts are anonymous shallow fetches of the public repo; drift's smoke job provisions its own token against a throwaway Forgejo container inside the job). If a future job ever needs forge write capabilities (e.g. drift filing an issue on failure), the right tool is an Authorized Integration scoped to that workflow file, ref, and event - not a permissions: block.

Follow-up: the fix landed in 4888f3b1 but had to be reverted in #306 - Forgejo does not support the workflow `permissions:` field at all; every run warned "not supported in Forgejo and will be ignored. Use Authorized Integrations to grant capabilities to this job instead." Forgejo's model is inverted from GitHub's ([Authorized Integrations docs](https://forgejo.org/docs/latest/user/authorized-integrations/)): the automatic Actions token starts with limited capabilities, and Authorized Integrations (repo Settings) *extend* it for jobs that need more - there is no workflow-side knob to restrict below the default, so this issue's mitigation ("remove the dependency on the forge's default staying read-only") has no Forgejo equivalent. No follow-up work needed for these workflows: neither uses the injected token at all (checkouts are anonymous shallow fetches of the public repo; drift's smoke job provisions its own token against a throwaway Forgejo container inside the job). If a future job ever needs forge write capabilities (e.g. drift filing an issue on failure), the right tool is an Authorized Integration scoped to that workflow file, ref, and event - not a `permissions:` block.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sixfold-space/madtea#273

No description provided.

Rows
Columns