Repository navigation
Restrict token permissions in PR validation - #240
Merged
Chetana Kethinedi (ch0707) merged 1 commit intoOct 16, 2026
Merged
Conversation
Limit GITHUB_TOKEN to contents: read and disable credential persistence on both checkout steps. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: bc09a152-a4a5-4204-a772-94001d65948b
Chetana Kethinedi (ch0707)
requested review from
Charles Gagnon (Charles-Gagnon) and
Matteo Taveggia (Matteo-T)
as code owners
October 15, 2026 19:51
There was a problem hiding this comment.
🟢 Approval recommended
The targeted security restrictions preserve existing workflow functionality, with no blocking issues identified.
0 open findings
What changed in this PR
Hardens PR validation by restricting token access for PR-controlled build and test code.
Changes:
- Limits workflow token permissions to
contents: read. - Disables credential persistence in both checkout steps.
- Preserves action pins, build/test commands, and artifact handling.
| File | Description |
|---|---|
.github/workflows/pr-validation.yml |
Restricts token permissions and disables checkout credential persistence. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Charles Gagnon (Charles-Gagnon)
approved these changes
Oct 15, 2026
Chetana Kethinedi (ch0707)
deleted the
ch0707-fix-pr-validation-permissions
branch
October 16, 2026 02:17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR validation executes PR-controlled build and test code, so it should not inherit broader GITHUB_TOKEN permissions or leave checkout credentials accessible to subsequent steps.
permissions: contents: read, which is sufficient for checkout and disables other configurable token permissions.persist-credentials: falseon both checkout steps to remove Git authentication after checkout.Existing action SHA pins, build/test commands, and artifact handling are unchanged. Artifact uploads and same-run downloads do not require additional GITHUB_TOKEN permissions. This addresses the CWE-732 concern without assuming that current repository defaults grant write access.
Validation: parsed the YAML, verified both checkout settings and read-only permissions, confirmed the remaining workflow matches main, and ran
git diff --check. End-to-end execution will occur in PR checks.