opensearch-project / opensearch-project/opensearch-java
Backport workflow-hardening fix (excessive-permissions) to 5 release branches
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 165
- Forks
- 250
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 26
Description
Summary
The default branch already hardened .github/workflows/delete_backport_branch.yml against the issue(s) below, but 5 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.
What's flagged (by zizmor)
excessive-permissions— workflow/job granted broaderpermissionsthan needed
Already resolved on the default branch in:
Affected release branches (5)
2.10.3(still present as of HEADe40f1281)2.11(still present as of HEAD72801252)2.10.4(still present as of HEADf29a574a)2.10.2(still present as of HEADfb27ae67)2.9.1(still present as of HEAD14cc4e50)
Suggested per-branch patches
Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)
2.10.3 — excessive-permissions
File .github/workflows/delete_backport_branch.yml; suggested edits:
-
- jobs.$J.permissions.contents = 'write'
--- a/.github/workflows/delete_backport_branch.yml
+++ b/.github/workflows/delete_backport_branch.yml
@@ -13,3 +13,5 @@
uses: SvanBoxel/delete-merged-branch@main
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ permissions:
+ contents: write
2.11 — excessive-permissions
File .github/workflows/delete_backport_branch.yml; suggested edits:
-
- jobs.$J.permissions.contents = 'write'
--- a/.github/workflows/delete_backport_branch.yml
+++ b/.github/workflows/delete_backport_branch.yml
@@ -13,3 +13,5 @@
uses: SvanBoxel/delete-merged-branch@main
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ permissions:
+ contents: write
2.10.4 — excessive-permissions
File .github/workflows/delete_backport_branch.yml; suggested edits:
-
- jobs.$J.permissions.contents = 'write'
--- a/.github/workflows/delete_backport_branch.yml
+++ b/.github/workflows/delete_backport_branch.yml
@@ -13,3 +13,5 @@
uses: SvanBoxel/delete-merged-branch@main
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ permissions:
+ contents: write
2.10.2 — excessive-permissions
File .github/workflows/delete_backport_branch.yml; suggested edits:
-
- jobs.$J.permissions.contents = 'write'
--- a/.github/workflows/delete_backport_branch.yml
+++ b/.github/workflows/delete_backport_branch.yml
@@ -13,3 +13,5 @@
uses: SvanBoxel/delete-merged-branch@main
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ permissions:
+ contents: write
2.9.1 — excessive-permissions
File .github/workflows/delete_backport_branch.yml; suggested edits:
-
- jobs.$J.permissions.contents = 'write'
--- a/.github/workflows/delete_backport_branch.yml
+++ b/.github/workflows/delete_backport_branch.yml
@@ -13,3 +13,5 @@
uses: SvanBoxel/delete-merged-branch@main
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ permissions:
+ contents: write
Happy to open pull requests instead if that's preferred.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Inspect .github/workflows/delete_backport_branch.yml on each listed release branch, using the default-branch commit as the reference. Run zizmor and actionlint against the affected workflow files, and confirm the excessive-permissions findings are cleared without new findings on all five branches.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, yaml
- Domain
- ci-cd, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100