Skip to content

fix: narrow down action permissions to per-job ones #828

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
steveiliop56 wants to merge 1 commit into
base: main
Choose a base branch
from
+40 −8
Open

fix: narrow down action permissions to per-job ones #828

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 17 additions & 2 deletions .github/workflows/nightly.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,13 @@ on:
- cron: "0 0 * * *"

permissions:
contents: write
packages: write
contents: read

jobs:
create-release:
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
Expand Down Expand Up @@ -145,6 +146,8 @@ jobs:
needs:
- create-release
- generate-metadata
permissions:
packages: read
Comment on lines +149 to +150
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot Apr 29, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🌐 Web query:

In GitHub Actions, when jobs.<job_id>.permissionsdefines onlypackages: read, are unspecified scopes (like contents) set to none? Also, what GITHUB_TOKENscope is required to push Docker images to GHCR usingdocker/build-push-action?

💡 Result:

Yes, when jobs.<job_id>.permissions defines only packages: read, unspecified scopes like contents are set to none. To push Docker images to GHCR using docker/build-push-action, the GITHUB_TOKEN requires packages: write permission (and typically contents: read for checkout).

Citations:

🏁 Script executed:

fd -t f "nightly.yml" --path "*workflows*"

Repository: tinyauthapp/tinyauth

Length of output: 298

🏁 Script executed:

fd -t f "nightly.yml"

Repository: tinyauthapp/tinyauth

Length of output: 46

🏁 Script executed:

find . -name "*.yml" -o -name "*.yaml" | grep -i workflow

Repository: tinyauthapp/tinyauth

Length of output: 252

🏁 Script executed:

wc -l ./.github/workflows/nightly.yml

Repository: tinyauthapp/tinyauth

Length of output: 100

🏁 Script executed:

cat -n ./.github/workflows/nightly.yml | sed -n '140,160p;200,220p;260,280p;320,340p'

Repository: tinyauthapp/tinyauth

Length of output: 2778

🏁 Script executed:

cat -n ./.github/workflows/nightly.yml | sed -n '151,195p;211,255p;271,315p;331,375p'

Repository: tinyauthapp/tinyauth

Length of output: 8276

Build jobs are under-scoped and will fail image publishing.

All four image-build jobs (at lines 149-150, 209-210, 269-270, and 329-330) have permissions set to packages: read, but these jobs perform checkout and push container images to GHCR with push=true. When job-level permissions are defined with only packages: read, unspecified scopes default to none. This means these jobs lack the required packages: write permission to push images and contents: read permission for checkout to function properly.

🔧 Proposed fix 
   image-build:
     runs-on: ubuntu-latest
     needs:
       - create-release
       - generate-metadata
     permissions:
-      packages: read
+      contents: read
+      packages: write

   image-build-distroless:
     runs-on: ubuntu-latest
     needs:
       - create-release
       - generate-metadata
       - image-build
     permissions:
-      packages: read
+      contents: read
+      packages: write

   image-build-arm:
     runs-on: ubuntu-24.04-arm
     needs:
       - create-release
       - generate-metadata
     permissions:
-      packages: read
+      contents: read
+      packages: write

   image-build-arm-distroless:
     runs-on: ubuntu-24.04-arm
     needs:
       - create-release
       - generate-metadata
       - image-build-arm
     permissions:
-      packages: read
+      contents: read
+      packages: write
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
permissions:
packages: read
permissions:
contents: read
packages: write
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/nightly.yml around lines 149 - 150, The image-build jobs
currently declare only "packages: read" which prevents checkout and GHCR pushes;
update each image-build job (the four image-build job definitions referenced) to
set job-level permissions to include "contents: read" and "packages: write" so
checkout works and images can be pushed (i.e., replace or augment the existing
permissions block for those image-build jobs with contents: read and packages:
write).

Copy link
Copy Markdown
Member Author

@steveiliop56 steveiliop56 May 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's not true, only the merge job needs write permissions, the other ones just upload it as artifact.

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot May 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@steveiliop56, I understand the confusion, but the image-build jobs are actually pushing to GHCR — just without a named tag. Looking at the Build and push step in each image-build job:

outputs: type=image,push-by-digest=true,name-canonical=true,push=true

The push=true here means docker/build-push-action pushes the image layers to ghcr.io/${{ github.repository_owner }}/tinyauth by digest. What gets uploaded to GitHub Actions artifacts is only a small text file containing the digest hash (e.g., abc123...), not the actual container image. The image-merge jobs then read those digest files and create a manifest list pointing to the already-pushed image layers.

So the flow is:

  1. image-build jobs → push image by digest to GHCR (packages: write needed) → upload digest hash as artifact
  2. image-merge jobs → download digest hashes → create manifest list on GHCR (packages: write needed)

Both stages write to GHCR. With only packages: read set at the job level, the build jobs will fail at the docker/build-push-action step with a permission denied error when trying to push the image digest layers.

steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
Expand Down Expand Up @@ -203,6 +206,8 @@ jobs:
- create-release
- generate-metadata
- image-build
permissions:
packages: read
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
Expand Down Expand Up @@ -261,6 +266,8 @@ jobs:
needs:
- create-release
- generate-metadata
permissions:
packages: read
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
Expand Down Expand Up @@ -319,6 +326,8 @@ jobs:
- create-release
- generate-metadata
- image-build-arm
permissions:
packages: read
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
Expand Down Expand Up @@ -377,6 +386,8 @@ jobs:
needs:
- image-build
- image-build-arm
permissions:
packages: write
steps:
- name: Download digests
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
Expand Down Expand Up @@ -416,6 +427,8 @@ jobs:
needs:
- image-build-distroless
- image-build-arm-distroless
permissions:
packages: write
steps:
- name: Download digests
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
Expand Down Expand Up @@ -455,6 +468,8 @@ jobs:
needs:
- binary-build
- binary-build-arm
permissions:
contents: write
steps:
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
with:
Expand Down
17 changes: 15 additions & 2 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,7 @@ on:
- "v*"

permissions:
contents: write
packages: write
contents: read

jobs:
generate-metadata:
Expand Down Expand Up @@ -117,6 +116,8 @@ jobs:
runs-on: ubuntu-latest
needs:
- generate-metadata
permissions:
packages: read
Comment on lines +119 to +120
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot Apr 29, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🌐 Web query:

For GitHub Actions job-level permissions, do unspecified scopes become none? For GHCR image publishing with docker/build-push-actionandGITHUB_TOKEN, is packages: write required?

💡 Result:

Yes, for GitHub Actions job-level permissions, unspecified scopes are set to none. Yes, packages: write is required for publishing images to GHCR using docker/build-push-action with GITHUB_TOKEN.

Citations:

🏁 Script executed:

# Check if the file exists and get its structure
file_path=".github/workflows/release.yml"
if [ -f "$file_path" ]; then
  echo "File exists. Line count:"
  wc -l "$file_path"
  echo ""
  echo "=== Lines 115-125 (around line 119) ==="
  sed -n '115,125p' "$file_path"
  echo ""
  echo "=== Lines 172-182 (around line 176) ==="
  sed -n '172,182p' "$file_path"
  echo ""
  echo "=== Lines 229-239 (around line 233) ==="
  sed -n '229,239p' "$file_path"
  echo ""
  echo "=== Lines 286-296 (around line 290) ==="
  sed -n '286,296p' "$file_path"
else
  echo "File not found at $file_path"
  git ls-files | grep -i release.yml
fi

Repository: tinyauthapp/tinyauth

Length of output: 1347

🏁 Script executed:

# Get full job definitions for the image-build jobs
echo "=== image-build job (lines 115-170) ==="
sed -n '115,170p' .github/workflows/release.yml

echo ""
echo "=== image-build-distroless job (lines 172-227) ==="
sed -n '172,227p' .github/workflows/release.yml

echo ""
echo "=== Checking for docker/build-push-action usage ==="
grep -n "docker/build-push-action" .github/workflows/release.yml

Repository: tinyauthapp/tinyauth

Length of output: 4738

Image build jobs missing required permissions for checkout and publish.

All four image build jobs (lines 119, 176, 233, 290) currently have only packages: read. With job-level permission blocks, unspecified scopes default to none, causing these jobs to fail:

  • actions/checkout requires contents: read to access repository code
  • docker/build-push-action with push=true to GHCR requires packages: write to publish images using GITHUB_TOKEN

Add both permissions to each affected job:

🔧 Proposed fix 
   image-build:
     runs-on: ubuntu-latest
     needs:
       - generate-metadata
     permissions:
-      packages: read
+      contents: read
+      packages: write

   image-build-distroless:
     runs-on: ubuntu-latest
     needs:
       - generate-metadata
       - image-build
     permissions:
-      packages: read
+      contents: read
+      packages: write

   image-build-arm:
     runs-on: ubuntu-24.04-arm
     needs:
       - generate-metadata
     permissions:
-      packages: read
+      contents: read
+      packages: write

   image-build-arm-distroless:
     runs-on: ubuntu-24.04-arm
     needs:
       - generate-metadata
       - image-build-arm
     permissions:
-      packages: read
+      contents: read
+      packages: write
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/release.yml around lines 119 - 120, The job-level
permissions for the image build jobs currently only specify "packages: read",
which prevents actions/checkout and docker build-push from working; update each
image build job's permissions block to include both "contents: read" and
"packages: write" (in addition to or replacing the existing packages: read) so
actions/checkout can access the repo and docker/build-push-action can push to
GHCR using GITHUB_TOKEN; locate the YAML permission blocks that currently
contain "permissions: packages: read" in the four image build jobs and add
"contents: read" and "packages: write" there.

Copy link
Copy Markdown
Member Author

@steveiliop56 steveiliop56 May 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's not true, only the merge job needs write permissions, the other ones just upload it as artifact.

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot May 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@steveiliop56, I appreciate the clarification, but I'd like to address both concerns separately:

Regarding packages: write:

Looking at the image-build jobs, the docker/build-push-action step does include push=true along with push-by-digest=true:

outputs: type=image,push-by-digest=true,name-canonical=true,push=true

The "upload as artifact" step only uploads the digest reference (a small text file containing the digest hash). The actual image layers are still pushed to GHCR during this job — push-by-digest=true just means the image is pushed without a named tag. Omitting packages: write causes the push to GHCR to fail, as GITHUB_TOKEN only has read access to packages by default — write access must be explicitly set.

Regarding contents: read:

This concern stands regardless. When you specify the access for any permission in a job-level permissions block, all permissions that are not specified are set to none — they are not inherited from the workflow-level permissions: contents: read. So the image-build jobs with only packages: read will have contents: none, causing actions/checkout to fail.

GitHub's own official documentation for publishing Docker images to GHCR shows the correct job-level permissions as contents: read and packages: write.

The fix remains the same as originally proposed — the image-build jobs need both:

permissions:
  contents: read
  packages: write

steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
Expand Down Expand Up @@ -172,6 +173,8 @@ jobs:
needs:
- generate-metadata
- image-build
permissions:
packages: read
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
Expand Down Expand Up @@ -227,6 +230,8 @@ jobs:
runs-on: ubuntu-24.04-arm
needs:
- generate-metadata
permissions:
packages: read
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
Expand Down Expand Up @@ -282,6 +287,8 @@ jobs:
needs:
- generate-metadata
- image-build-arm
permissions:
packages: read
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
Expand Down Expand Up @@ -338,6 +345,8 @@ jobs:
needs:
- image-build
- image-build-arm
permissions:
packages: write
steps:
- name: Download digests
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
Expand Down Expand Up @@ -379,6 +388,8 @@ jobs:
needs:
- image-build-distroless
- image-build-arm-distroless
permissions:
packages: write
steps:
- name: Download digests
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
Expand Down Expand Up @@ -422,6 +433,8 @@ jobs:
needs:
- binary-build
- binary-build-arm
permissions:
contents: write
steps:
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
with:
Expand Down
6 changes: 4 additions & 2 deletions .github/workflows/sponsors.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,12 +3,14 @@ on:
workflow_dispatch:

permissions:
contents: write
pull-requests: write
contents: read

jobs:
generate-sponsors:
runs-on: ubuntu-latest
permissions:
contents: write
pull-requests: write
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
Expand Down
6 changes: 4 additions & 2 deletions .github/workflows/stale.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,14 @@ on:
- cron: 0 10 * * *

permissions:
issues: write
pull-requests: write
contents: read

jobs:
stale:
runs-on: ubuntu-latest
permissions:
issues: write
pull-requests: write
steps:
- uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10
with:
Expand Down
Loading