From eb9e18d2da89f5bf1dd909c9c701d3040869e595 Mon Sep 17 00:00:00 2001 From: tannevaled Date: Mon, 31 Aug 2026 11:13:44 +0200 Subject: [PATCH] ci: grant publishing permissions to the deploy job only The workflow-level permissions block applied to every job, so the build that runs on a pull request held a token able to publish the site. Nothing leaked: the deploy job is gated on the branch and a pull request never reaches it. But a pull request build is exactly where third-party code runs -- a dependency resolved during the build, an action at a floating tag -- and it should not run holding a token it has no use for. The publishing grant moves down to the deploy job. The workflow keeps only what the build actually reads. Co-Authored-By: Claude Opus 5 --- .github/workflows/pages.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index b89320d..92d9a1e 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -11,10 +11,12 @@ on: pull_request: workflow_dispatch: +# The build needs nothing beyond the source and the Pages configuration it +# reads to compute the base URL. Publishing rights are granted to the deploy +# job alone, below, so a pull request build cannot replace what is served. permissions: contents: read - pages: write - id-token: write + pages: read concurrency: group: pages @@ -54,6 +56,10 @@ jobs: if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' needs: build runs-on: ubuntu-latest + permissions: + contents: read + pages: write + id-token: write environment: name: github-pages url: ${{ steps.deployment.outputs.page_url }}