ci: scope GitHub Actions permissions to jobs (Aikido)#12
Merged
Conversation
…erly-broad-permissions)
Move workflow-level permissions into the build job and set the workflow-level
permissions to {} so future jobs must opt in explicitly. Resolves Aikido
sub-issues #211116553 and #211116554.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
pnpm-action-setup currently resolves 'latest' to pnpm v11, which dropped the legacy package.json pnpm.* config keys and bumped the minimum Node requirement. This repo has not migrated, so 'pnpm install' has been failing on every CI run since pnpm v11 shipped. Pin to v10 to restore the previous working state without touching project layout or Node version. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
permissions: { contents: write, packages: write }into thebuildjob; set the workflow level topermissions: {}so future jobs must opt in explicitly. Resolves AikidoAIK_yaml_gh-actions-overly-broad-permissions(CWE-250).pnpm-action-setuptoversion: 10.latestnow resolves to pnpm v11, which drops the legacypackage.jsonpnpm.*config keys and bumps the minimum Node requirement;pnpm installhas been failing on every CI run since v11 shipped. Pinning to v10 restores the previous working state without changing the project layout or Node matrix.Aikido Issues Resolved
contents: writeat workflow levelpackages: writeat workflow levelWhy this PR is split from a previous attempt
Earlier PR #11 also bumped the Node matrix to 22.x and added
pnpm.onlyBuiltDependenciestopackage.jsonto work around two unrelated pnpm v11 breakages. Those changes are out of scope for an Aikido permissions fix and should be decided separately — this PR keeps the diff to the minimum needed to land the security fix.Verification