fix: add explicit permissions to GitHub Actions workflows #2252
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Add permissions block to phpcs_on_pull_request.yml (contents: read, pull-requests: write) - Add permissions block to create.yml (contents: read) - Add permissions block to playwright.yml (contents: read) This follows the principle of least privilege and resolves GitHub code scanning alerts #1, #2, and #39. Fixes: rtCamp/support#245
Contributor
There was a problem hiding this comment.
Pull request overview
This PR enhances security by adding explicit permissions: blocks to three GitHub Actions workflows, following the principle of least privilege and resolving code scanning alerts. Previously, these workflows ran with default GITHUB_TOKEN permissions which could be overly permissive.
- Added minimal read-only permissions to workflows that only need to checkout code
- Granted write permissions only where needed (PR comments in PHPCS workflow)
- Addressed security scanning alerts #1, #2, and #39
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
.github/workflows/playwright.yml |
Added contents: read permission for E2E test workflow that checks out code and uploads test artifacts |
.github/workflows/phpcs_on_pull_request.yml |
Added contents: read and pull-requests: write permissions for PHPCS inspection workflow that posts review comments |
.github/workflows/create.yml |
Added contents: read permission for deployment workflow that checks out code and publishes to WordPress.org via SVN |
The changes in this PR are well-structured and follow GitHub's security best practices. All three workflows have been assigned appropriate minimal permissions:
- playwright.yml correctly uses
contents: readfor code checkout and artifact uploads - phpcs_on_pull_request.yml appropriately includes both
contents: readandpull-requests: write(note: the workflow uses a custom bot token for posting comments, but declaring the permission is still correct for transparency) - create.yml correctly uses
contents: readfor deployment operations
No issues were identified in this security-focused improvement.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
mrrobot47
approved these changes
Jan 1, 2026
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds explicit
permissions:blocks to all GitHub Actions workflows to follow the principle of least privilege and resolve security scanning alerts.Changes
1. phpcs_on_pull_request.yml
permissions: contents: read, pull-requests: write2. create.yml
permissions: contents: read3. playwright.yml
permissions: contents: readSecurity Impact
Resolves: Code scanning alerts #1, #2, #39
Previously, these workflows ran with default GITHUB_TOKEN permissions which could be overly permissive. This change explicitly limits each workflow to only the permissions it needs.
References