From 6fffafd8c78e2a08e32a492a399d125305d612d8 Mon Sep 17 00:00:00 2001 From: bgard68 <30295154+bgard68@users.noreply.github.com> Date: Mon, 14 Sep 2026 07:33:08 -0500 Subject: [PATCH] ci: least-privilege permissions for the auto-merge workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Scopes pull-requests: write onto the one job that needs it and drops the workflow-wide contents: write (enabling auto-merge doesn't need it — the merge is performed later by GitHub), leaving the workflow default read-only. Adds timeout-minutes. Matches the shape DevSecOpsSentinel's own workflow scanner requires (GHA002/GHA003). Co-Authored-By: Claude Opus 5 --- .github/workflows/dependabot-auto-merge.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 74da403..3e632b0 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -11,14 +11,20 @@ name: Dependabot auto-merge on: pull_request +# Read-only by default; the one job that needs it grants itself the minimum below. permissions: - contents: write # enable auto-merge on the PR - pull-requests: write # required by gh pr merge + contents: read jobs: auto-merge: if: github.actor == 'dependabot[bot]' runs-on: ubuntu-latest + timeout-minutes: 5 + # Scoped to the job, not the workflow: enabling auto-merge is a pull-request + # write, and the merge itself is performed later by GitHub, so nothing here + # needs contents: write (least privilege). + permissions: + pull-requests: write steps: - name: Fetch Dependabot metadata id: meta