open-telemetry / open-telemetry/opentelemetry-python-contrib

Backport workflow-hardening fix (excessive-permissions) to 5 release branches

Open

#4,755 opened on Jun 29, 2026 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language: Python
Stars: 1.1k
Forks: 1.1k
Avg merge: 4d 15h
Merged PRs (30d): 16

Description

Summary

The default branch already hardened .github/workflows/component-owners.yml against the issue(s) below, but 5 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

What's flagged (by zizmor)

excessive-permissions — workflow/job granted broader permissions than needed

Already resolved on the default branch in:

https://github.com/open-telemetry/opentelemetry-python-contrib/commit/c59b514cdadfe062c69f8e055d7c1aa4b56dc92e

Affected release branches (5)

release/v1.29.x-0.50bx (still present as of HEAD 2480f4e8)
release/v1.28.x-0.49bx (still present as of HEAD 54e684aa)
release/v1.27.x-0.48bx (still present as of HEAD dcbf1fd9)
release/v1.26.x-0.47bx (still present as of HEAD 44098b91)
release/v1.24.x-0.45bx (still present as of HEAD f431b074)

Suggested per-branch patches

Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

release/v1.29.x-0.50bx — excessive-permissions

File .github/workflows/component-owners.yml; suggested edits:

- jobs.$J.permissions.contents = 'read'
- jobs.$J.permissions.issues = 'write'
- jobs.$J.permissions.pull-requests = 'write'

--- a/.github/workflows/component-owners.yml
+++ b/.github/workflows/component-owners.yml
@@ -15,3 +15,7 @@
     continue-on-error: true
     steps:
       - uses: dyladan/component-owners@main
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write

release/v1.28.x-0.49bx — excessive-permissions

File .github/workflows/component-owners.yml; suggested edits:

- jobs.$J.permissions.contents = 'read'
- jobs.$J.permissions.issues = 'write'
- jobs.$J.permissions.pull-requests = 'write'

--- a/.github/workflows/component-owners.yml
+++ b/.github/workflows/component-owners.yml
@@ -15,3 +15,7 @@
     continue-on-error: true
     steps:
       - uses: dyladan/component-owners@main
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write

release/v1.27.x-0.48bx — excessive-permissions

File .github/workflows/component-owners.yml; suggested edits:

- jobs.$J.permissions.contents = 'read'
- jobs.$J.permissions.issues = 'write'
- jobs.$J.permissions.pull-requests = 'write'

--- a/.github/workflows/component-owners.yml
+++ b/.github/workflows/component-owners.yml
@@ -15,3 +15,7 @@
     continue-on-error: true
     steps:
       - uses: dyladan/component-owners@main
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write

release/v1.26.x-0.47bx — excessive-permissions

File .github/workflows/component-owners.yml; suggested edits:

- jobs.$J.permissions.contents = 'read'
- jobs.$J.permissions.issues = 'write'
- jobs.$J.permissions.pull-requests = 'write'

--- a/.github/workflows/component-owners.yml
+++ b/.github/workflows/component-owners.yml
@@ -15,3 +15,7 @@
     continue-on-error: true
     steps:
       - uses: dyladan/component-owners@main
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write

release/v1.24.x-0.45bx — excessive-permissions

File .github/workflows/component-owners.yml; suggested edits:

- jobs.$J.permissions.contents = 'read'
- jobs.$J.permissions.issues = 'write'
- jobs.$J.permissions.pull-requests = 'write'

--- a/.github/workflows/component-owners.yml
+++ b/.github/workflows/component-owners.yml
@@ -15,3 +15,7 @@
     continue-on-error: true
     steps:
       - uses: dyladan/component-owners@main
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write

Happy to open pull requests instead if that's preferred.

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Research direction

Start with .github/workflows/component-owners.yml on each of the five listed release branches, using the default-branch commit c59b514cdadfe062c69f8e055d7c1aa4b56dc92e as the reference. Apply the documented workflow permission changes, then run zizmor and actionlint for each branch. Done means all five branches pass both checks without new findings.

Written by the indexing model from the issue text.

Assessment

Tech stack: github-actions
Domain: ci-cd, security
Issue type: Bug
Difficulty: 3/5
Estimated time: 1-2 days
Activity status: Active
Clarity: Clearly specified
Newbie friendliness: 76/100

A short digest of beginner-friendly GitHub issues.