#23453 Backport workflow-hardening fix (excessive-permissions) to 5 release branches Issue created by CharlieMCY Summary The default branch already hardened

.github/workflows/test.yaml

against the issue(s) below, but 5 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each. What's flagged (by zizmor) •

excessive-permissions

— workflow/job granted broader

permissions

than needed Already resolved on the default branch in: • 4e3f86f Affected release branches (5) •

2.29.x

(still present as of HEAD

bb724884

) •

2.28.x

(still present as of HEAD

dd39c257

) •

2.27.x

(still present as of HEAD

2a9f6e71

) •

2.32.x

(still present as of HEAD

a31479da

) •

2.31.x

(still present as of HEAD

005e77b8

) Suggested per-branch patches Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

2.29.x

— excessive-permissions File `.github/workflows/test.yaml`; suggested edits: • • jobs.$J.permissions.attestations = 'write' • • jobs.$J.permissions.contents = 'read' • • jobs.$J.permissions.id-token = 'write' • • jobs.$J2.permissions.attestations = 'write' • • jobs.$J2.permissions.contents = 'read' • • jobs.$J2.permissions.id-token = 'write' • • jobs.$J3.permissions.attestations = 'write' • • jobs.$J3.permissions.contents = 'read' • • jobs.$J3.permissions.id-token = 'write' • • jobs.$J4.permissions.attestations = 'write' • • jobs.$J4.permissions.contents = 'read' • • jobs.$J4.permissions.id-token = 'write' --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -323,7 +323,7 @@ - classify_changes permissions: attestations: write - contents: write + contents: read id-token: write runs-on: - self-hosted @@ -396,7 +396,7 @@ - classify_changes permissions: attestations: write - contents: write + contents: read id-token: write runs-on: - ubuntu-22.04 @@ -467,7 +467,7 @@ - classify_changes permissions: attestations: write - contents: write + contents: read id-token: write runs-on: - macos-13 @@ -552,7 +552,7 @@ - classify_changes permissions: attestations: write - contents: write + contents: read id-token: write runs-on: - macos-14

2.28.x

— excessive-permissions File `.github/workflows/test.yaml`; suggested edits: • • jobs.$J.permissions.attestations = 'write' • • jobs.$J.permissions.contents = 'read' • • jobs.$J.permissions.id-token = 'write' • • jobs.$J2.permissions.attestations = 'write' • • jobs.$J2.permissions.contents = 'read' • • jobs.$J2.permissions.id-token = 'write' • • jobs.$J3.permissions.attestations = 'write' • • jobs.$J3.permissions.contents = 'read' • • jobs.$J3.permissions.id-token = 'write' • • jobs.$J4.permissions.attestations = 'write' • • jobs.$J4.permissions.contents = 'read' • • jobs.$J4.permissions.id-token = 'write' --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -349,7 +349,7 @@ - classify_changes permissions: attestations: write - contents: write + contents: read id-token: write runs-on: - self-hosted @@ -430,7 +430,7 @@ - classify_changes permissions: attestations: write - contents: write + contents: read id-token: write runs-on: - ubuntu-22.04 @@ -509,7 +509,7 @@ - classify_changes permissions: attestations: write - contents: write + contents: read id-token: write runs-on: - macos-13 @@ -598,7 +598,7 @@ - classify_changes permissions: attestations: write - contents: write + contents: read id-token: write runs-on: - macos-14

2.27.x

— excessive-permissions File `.github/workflows/test.yaml`; suggested edits: • • jobs.$J.permissions.attestations = 'write' • • jobs.$J.permissions.contents = 'read' • • jobs.$J.permissions.id-token = 'write' • • jobs.$J2.permissions.attestations = 'write' • • jobs.$J2.permissions.contents = 'read' • • jobs.$J2.permissions.id-token = 'write' • • jobs.$J3.permissions.attestations = 'write' • • jobs.$J3.permissions.contents = 'read' • • jobs.$J3.permissions.id-token = 'write' • • jobs.$J4.permissions.attestations = 'write' • • jobs.$J4.permissions.contents = 'read' • • jobs.$J4.permissions.id-token = 'write' --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -349,7 +349,7 @@ - classify_changes permissions: attestations: write - contents: write + contents: read id-token: write runs-on: - self-hosted @@ -430,7 +430,7 @@ - classify_changes permissions: attestations: write - contents: write + contents: read id-token: write runs-on: - ubuntu-22.04 @@ -509,7 +509,7 @@ - classify_changes permissions: attestations: write - contents: write + contents: read id-token: write runs-on: - macos-13 @@ -598,7 +598,7 @@ - classify_changes permissions: attestations: write - contents: write + contents: read id-token: write runs-on: - macos-14

2.32.x

— excessive-permissions File `.github/workflows/test.yaml`; suggested edits: • • jobs.$J.permissions.attestations = 'write' • • jobs.$J.permissions.contents = 'read' • • jobs.$J.permissions.id-token = 'write' • • jobs.$J2.permissions.attestations = 'write' • • jobs.$J2.permissions.contents = 'read' • • jobs.$J2.permissions.id-token = 'write' • • jobs.$J3.permissions.attestations = 'write' • • jobs.$J3.permissions.contents = 'read' • • jobs.$J3.permissions.id-token = 'write' • • jobs.$J4.permissions.attestations = 'write' • • jobs.$J4.permissions.contents = 'read' • • jobs.$J4.permissions.id-token = 'write' --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -360,7 +360,7 @@ - classify_changes permissions: attestations: write - contents: write + contents: read id-token: write runs-on: - depot-ubuntu-24.04-arm-8 @@ -440,7 +440,7 @@ - classify_changes permissions: attestations: write - contents: write + contents: read id-token: write runs-on: - depot-ubuntu-22.04-8 @@ -526,7 +526,7 @@ - classify_changes permissions: attestations: write - contents: write + contents: read id-token: write runs-on: - depot-macos-14

2.31.x

— excessive-permissions File `.github/workflows/test.yaml`; suggested edits: • • jobs.$J.permissions.attestations = 'write' • • jobs.$J.permissions.contents = 'read' • • jobs.$J.permissions.id-token = 'write' • • jobs.$J2.permissions.attestations = 'write' • • jobs.$J2.permissions.contents = 'read' • • jobs.$J2.permissions.id-token = 'write' • • jobs.$J3.permissions.attestations = 'write' • • jobs.$J3.permissions.contents = 'read' • • jobs.$J3.permissions.id-token = 'write' • • jobs.$J4.permissions.attestations = 'write' • • jobs.$J4.permissions.contents = 'read' • • jobs.$J4.permissions.id-token = 'write' --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -357,7 +357,7 @@ - classify_changes permissions: attestations: write - contents: write + contents: read id-token: write runs-on: - depot-ubuntu-24.04-arm-8 @@ -436,7 +436,7 @@ - classify_changes permissions: attestations: write - contents: write + contents: read id-token: write runs-on: - depot-ubuntu-22.04-8 @@ -519,7 +519,7 @@ - classify_changes permissions: attestations: write - contents: write + contents: … pantsbuild/pants