[release/0.5] Restrict GITHUB_TOKEN permissions on linux_job.yml callers by shahtirth07 · Pull Request #23194 · pytorch/executorch

shahtirth07 · 2026-09-28T18:50:14Z

Summary

Backports the excessive-permissions fix from #20588 to release/0.5.

Adds permissions: contents: read to:

build-llm-demo in .github/workflows/_android.yml
linux in .github/workflows/_unittest.yml (not listed in the issue, but zizmor flags it the same way)

These jobs call test-infra's linux_job.yml (v1), which doesn't use OIDC, so I left out the id-token: write that main has. Happy to add it if you'd rather match main exactly.

I have the same change ready for release/0.4, 0.3 and 0.2 and will open those once this one looks good.

Part of #20588

Test plan

zizmor 1.30.1 (--offline) on both files, before and after:

Before: excessive-permissions reported on build-llm-demo and linux
After: both findings cleared, no new findings

actionlint on both files: no new errors. The two remaining ones (the custom runner label linux.24xl.spr-metal and actions/checkout@v3) are on lines this PR doesn't change.

cc @nil-is-all

pytorch-bot · 2026-09-28T18:50:17Z

🔗 Helpful Links

🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/executorch/23194

📄 Preview Python docs built from this PR

Note: Links to docs will display an error until the docs builds have been completed.

❌ 29 New Failures, 1 Unclassified Failure

As of commit 2d5ce3f with merge base 9069017 ():

NEW FAILURES - The following jobs have failed:

Build documentation / build (buck2) / Build doc (gh)
executorch
pull / test-custom-ops-linux / linux-job (gh)
executorch
pull / test-eval_llama-mmlu-linux / linux-job (gh)
executorch
pull / test-eval_llama-wikitext-linux / linux-job (gh)
executorch
pull / test-llama_runner_eager-linux / linux-job (gh)
executorch
pull / test-llama-runner-linux (bf16, custom) / linux-job (gh)
executorch
pull / test-llama-runner-linux (bf16, portable) / linux-job (gh)
executorch
pull / test-llama-runner-linux (fp32, portable) / linux-job (gh)
executorch
pull / test-llama-runner-linux (fp32, xnnpack+custom) / linux-job (gh)
executorch
pull / test-llama-runner-linux (fp32, xnnpack+custom+qe) / linux-job (gh)
executorch
pull / test-llama-runner-linux (fp32, xnnpack+custom+quantize_kv) / linux-job (gh)
executorch
pull / test-llama-runner-linux (fp32, xnnpack+quantize_kv) / linux-job (gh)
executorch
pull / test-llama-runner-qnn-linux (fp32, qnn_16a16w, qnn) / linux-job (gh)
executorch
pull / test-llama-runner-qnn-linux (fp32, qnn_8a8w, qnn) / linux-job (gh)
executorch
pull / test-llava-runner-linux / linux-job (gh)
executorch
pull / test-models-linux (buck2, mv3, portable, linux.2xlarge, 90) / linux-job (gh)
executorch
pull / test-models-linux (buck2, mv3, xnnpack-quantization-delegation, linux.2xlarge, 90) / linux-job (gh)
executorch
pull / test-models-linux (cmake, mv3, portable, linux.2xlarge, 90) / linux-job (gh)
executorch
pull / test-models-linux (cmake, mv3, xnnpack-quantization-delegation, linux.2xlarge, 90) / linux-job (gh)
executorch
pull / test-models-linux (cmake, vit, portable, linux.2xlarge, 90) / linux-job (gh)
executorch
pull / test-models-linux (cmake, vit, xnnpack-quantization-delegation, linux.2xlarge, 90) / linux-job (gh)
executorch
pull / test-phi-3-mini-runner-linux / linux-job (gh)
executorch
pull / test-pybind-build-linux / linux-job (gh)
executorch
pull / test-quantized-aot-lib-linux / linux-job (gh)
executorch
pull / test-selective-build-linux / linux-job (gh)
executorch
pull / test-setup-linux-gcc / linux-job (gh)
executorch
pull / unittest / linux / linux-job (gh)
executorch
pull / unittest / macos / macos-job (gh)
RuntimeError: Command bash /Users/ec2-user/runner/_work/_temp/exec_script failed with exit code 1
pull / unittest-arm / linux-job (gh)
executorch

UNCLASSIFIED FAILURE - DrCI could not classify the following job because the workflow did not run on the merge base. The failure may be pre-existing on trunk or introduced by this PR:

Cadence Build & Test / Resolve CI docker image / resolve (gh) (this job did not run on the merge base, so DrCI cannot tell whether the failure is pre-existing)
##[error]Refusing to check out fork pull request code from a 'pull_request_target' workflow. This workflow runs with the base repository's GITHUB_TOKEN, secrets, default-branch cache scope, and runner access. Fetching and executing a fork's code in that trusted context commonly leads to "pwn request" vulnerabilities. To opt in, review the risks at https://gh.io/securely-using-pull_request_target and set 'allow-unsafe-pr-checkout: true' on the actions/checkout step.

This comment was automatically generated by Dr. CI and updates every 15 minutes.

meta-cla · 2026-09-28T18:50:20Z

Hi @shahtirth07!

Thank you for your pull request and welcome to our community.

Action Required

In order to merge any pull request (code, docs, etc.), we require contributors to sign our Contributor License Agreement, and we don't seem to have one on file for you.

Process

In order for us to review and merge your suggested changes, please sign at https://code.facebook.com/cla. If you are contributing on behalf of someone else (eg your employer), the individual CLA may not be sufficient and your employer may need to sign the corporate CLA.

Once the CLA is signed, our tooling will perform checks and validations. Afterwards, the pull request will be tagged with CLA signed. The tagging process may take up to 1 hour after signing. Please give it that time before contacting us about it.

If you have received this in error or have any questions, please contact us at cla@meta.com. Thanks!

linux-foundation-easycla · 2026-09-28T18:50:27Z

The committers listed above are authorized under a signed CLA.

✅ login: shahtirth07 / name: Tirth Shah (2d5ce3f)

Add to the build-llm-demo job in _android.yml and the linux job in _unittest.yml. These jobs call test-infra's linux_job.yml (v1), which uses no OIDC token, so contents: read is enough. Clears zizmor's excessive-permissions finding on both jobs. Refs pytorch#20588

shahtirth07 · 2026-09-28T19:01:05Z

Hi @rascani, I opened #23194 to backport this to release/0.5. It adds contents: read to the flagged job, plus the linux job in _unittest.yml, which zizmor flags the same way. If this looks good, I'll open the same change for release/0.4, 0.3 and 0.2.

nil-is-all · 2026-09-28T21:45:45Z

And could you rebase with latest main branch to resolve Ci failures?

shahtirth07 · 2026-09-29T05:37:08Z

Thanks for taking a look! @nil-is-all This PR targets release/0.5 rather than main, so rebasing onto main would pull all of main's history into the release branch. The branch is already on the latest release/0.5 (1bc0699, no new commits since Feb 2025).

I think the failures are pre-existing on release/0.5 rather than caused by this change. Most of the failing jobs (test-models-linux, test-llama-runner-linux, the docs build, unittest/macos) come from workflows this PR doesn't touch. They fail inside the test script, which looks like the old branch's CI dependencies no longer resolving.

Would you like me to do anything else here, or is it OK to merge with the release-branch CI in this state? If the old release branches aren't worth updating, I'm also happy to close this.

nil-is-all · 2026-09-29T17:21:11Z

@claude review CI failures and the code changes to check any relevant failures apart from dependency failures

claude · 2026-09-29T17:22:22Z

Claude finished @nil-is-all's task in 1m 58s —— View job

CI failure review + code review

Read the PR diff
Look at the failing job logs, especially unittest / linux, which runs through a workflow this PR changes
Compare them with failures in workflows this PR doesn't touch
Post findings

Bottom line: None of the CI failures are caused by this PR. They come from four separate problems, and each one is a toolchain or dependency issue or a platform change: the new CMake 4.x, PyPI dependency drift, and GitHub's new pull_request_target checkout guard. The two-file change itself looks correct.

CI failures, grouped by root cause

#	Jobs	Root cause	Caused by this PR?
1	All 27 failing `pull / *-linux / linux-job` jobs, including `unittest / linux` (the one this PR touches), plus `Build documentation / build (buck2)`	The runner installs CMake 4.4.x, which no longer supports `cmake_minimum_required` values below 3.5. The old `third-party/gflags` submodule on release/0.5 still asks for one: `CMake Error at third-party/gflags/CMakeLists.txt:73 (cmake_minimum_required): Compatibility with CMake < 3.5 has been removed from CMake.` This happens during `pip install .` in `setup-linux.sh`, so the executorch wheel never builds.	❌ No
2	`unittest / macos / macos-job`	Dependency resolution fails in `install_requirements.py`: `torchaudio 2.6.0 depends on torch==2.7.0` conflicts with the pinned `torch==2.6.0`, and the `torch` pin has no matching distribution on the `whl/test/cpu` index anymore.	❌ No (macOS job, not changed here)
3	`Cadence Build & Test / Resolve CI docker image`	`actions/checkout` now refuses to check out fork code from a `pull_request_target` workflow unless `allow-unsafe-pr-checkout: true` is set. This is a platform change, and DrCI notes the job didn't run on the merge base.	❌ No (workflow not changed here)
4	`test-llama-runner-linux (…)`: failing "Upload artifacts to S3" step	Knock-on failure: the build failed first (#1), so there was nothing to upload.	❌ No

Evidence that the permission change is safe:

unittest / linux uses _unittest.yml, which this PR changes. The reusable workflow linux_job.yml@release/2.6 started with permissions: contents: read, checked out the code, pulled the docker image, and got all the way into the build script before hitting the same CMake error as every other Linux job. If it had needed a permission it didn't have, such as id-token: write, GitHub would have rejected the run at startup, before any step ran. This confirms that contents: read is enough for linux_job.yml v1.
Other jobs using the same linux_job.yml passed on this commit: test-binary-size-linux, test-binary-size-linux-gcc, test-llama-runner-linux-android and test-mediatek-models-linux. None of them run the failing CMake pip install . path, so the runner, docker and checkout setup is working.
The failing Linux jobs outside _unittest.yml (in pull.yml, doc-build.yml) fail in exactly the same way. Their workflows aren't changed by this PR, so the problem already exists on release/0.5.

Not exercised by CI: android / build-llm-demo was skipped because it needs: test-llama-runner-linux, which failed from #1. The _android.yml change therefore has no CI signal on this PR. It calls the same linux_job.yml@release/2.6 that the unittest / linux evidence covers, and its upload-artifact-to-s3 upload doesn't depend on GITHUB_TOKEN scopes. The risk is low, but a maintainer should know it wasn't run.

Code review

# .github/workflows/_android.yml:10-12  and  .github/workflows/_unittest.yml:17-19
    uses: pytorch/test-infra/.github/workflows/linux_job.yml@release/2.6
    permissions:
      contents: read

✅ Correct placement: a job-level permissions on a uses: job limits the token passed to the called workflow.
✅ Leaving out id-token: write is fine for linux_job.yml v1. It doesn't use OIDC, as the unittest / linux run above shows. The other callers on this branch that grant id-token: write (e.g. pull.yml:336, trunk.yml:135) call workflows that need AWS OIDC, which isn't the case here.
✅ Adding the _unittest.yml linux job, even though it isn't listed in the issue, is reasonable and keeps things consistent.
ℹ️ Optional, not blocking: the run-emulator job in _android.yml:34 still runs with default token permissions and passes secrets.GITHUB_TOKEN to setup-ssh. zizmor didn't flag it in the author's run, so it's out of scope, but permissions: contents: read would fit there too if you want full coverage.

Recommendation

The change is correct, and the failures are problems that already exist on release/0.5. Rebasing onto main is not appropriate for a release/0.5 backport, as the author noted. Fixing CI on this branch would need its own backports: a CMake < 4 pin or -DCMAKE_POLICY_VERSION_MINIMUM=3.5, plus torch/torchaudio pin fixes. Those belong in separate PRs. Merging this despite the red CI, or dropping the old-branch backports, is up to the maintainers.

rascani · 2026-10-12T21:59:40Z

CI is largely broken on older release branches, hence the failing checks. I merged this anyways, as it is still the correct fix.

shahtirth07 force-pushed the fix-perms-release-0.5 branch from 53eea3b to 2d5ce3f Compare September 28, 2026 18:56

meta-cla Bot added the CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. label Sep 28, 2026

executorch-triage Bot added the community: contribution PRs coming from community (excluding hardware partners) label Sep 28, 2026

nil-is-all requested a review from rascani September 28, 2026 20:24

nil-is-all assigned rascani Sep 28, 2026

rascani approved these changes Oct 12, 2026

View reviewed changes

rascani merged commit 9caa7eb into pytorch:release/0.5 Oct 12, 2026
23 of 54 checks passed

nil-is-all mentioned this pull request Oct 13, 2026

Backport workflow-hardening fix (excessive-permissions) to 4 release branches #20588

Open

Navigation Menu

Repository navigation

[release/0.5] Restrict GITHUB_TOKEN permissions on linux_job.yml callers - #23194

[release/0.5] Restrict GITHUB_TOKEN permissions on linux_job.yml callers#23194
rascani merged 1 commit into
pytorch:release/0.5from
shahtirth07:fix-perms-release-0.5

shahtirth07 commented Sep 28, 2026 •

edited by pytorch-bot Bot

Loading

Uh oh!

pytorch-bot Bot commented Sep 28, 2026 •

edited

Loading

Uh oh!

meta-cla Bot commented Sep 28, 2026

Uh oh!

linux-foundation-easycla Bot commented Sep 28, 2026 •

edited

Loading

Uh oh!

shahtirth07 commented Sep 28, 2026

Uh oh!

nil-is-all commented Sep 28, 2026

Uh oh!

shahtirth07 commented Sep 29, 2026

Uh oh!

nil-is-all commented Sep 29, 2026

Uh oh!

claude Bot commented Sep 29, 2026 •

edited

Loading

Uh oh!

Uh oh!

rascani commented Oct 12, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

shahtirth07 commented Sep 28, 2026 • edited by pytorch-bot Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

pytorch-bot Bot commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔗 Helpful Links

🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/executorch/23194

❌ 29 New Failures, 1 Unclassified Failure

Uh oh!

meta-cla Bot commented Sep 28, 2026

Action Required

Process

Uh oh!

linux-foundation-easycla Bot commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

shahtirth07 commented Sep 28, 2026

Uh oh!

nil-is-all commented Sep 28, 2026

Uh oh!

shahtirth07 commented Sep 29, 2026

Uh oh!

nil-is-all commented Sep 29, 2026

Uh oh!

claude Bot commented Sep 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CI failure review + code review

CI failures, grouped by root cause

Code review

Recommendation

Uh oh!

Uh oh!

rascani commented Oct 12, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

shahtirth07 commented Sep 28, 2026 •

edited by pytorch-bot Bot

Loading

pytorch-bot Bot commented Sep 28, 2026 •

edited

Loading

linux-foundation-easycla Bot commented Sep 28, 2026 •

edited

Loading

claude Bot commented Sep 29, 2026 •

edited

Loading