Backport workflow-hardening fix (excessive-permissions) to 4 release branches
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 5k
- Forks
- 1.2k
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 581
Description
Summary
The default branch already hardened .github/workflows/_android.yml, .github/workflows/_unittest.yml against the issue(s) below, but 4 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.
What's flagged (by zizmor)
excessive-permissions— workflow/job granted broaderpermissionsthan needed
Already resolved on the default branch in:
Affected release branches (4)
release/0.5(still present as of HEAD1bc0699a)release/0.4(still present as of HEAD6a085fff)release/0.3(still present as of HEADca8e0d23)release/0.2(still present as of HEAD088cedfb)
Suggested per-branch patches
Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)
release/0.5 — excessive-permissions
File .github/workflows/_android.yml; suggested edits:
-
- jobs.$J.permissions.contents = 'read'
-
- jobs.$J.permissions.id-token = 'write'
--- a/.github/workflows/_android.yml
+++ b/.github/workflows/_android.yml
@@ -29,6 +29,9 @@
bash build/build_android_llm_demo.sh ${ARTIFACTS_DIR_NAME}
# Running Android emulator directly on the runner and not using Docker
+ permissions:
+ contents: read
+ id-token: write
run-emulator:
needs: build-llm-demo
# NB: Use metal install for KVM support to run the emulator faster
release/0.4 — excessive-permissions
File .github/workflows/_unittest.yml; suggested edits:
-
- jobs.$J.permissions.contents = 'read'
-
- jobs.$J.permissions.id-token = 'write'
--- a/.github/workflows/_unittest.yml
+++ b/.github/workflows/_unittest.yml
@@ -43,6 +43,9 @@
LLVM_PROFDATA=llvm-profdata-12 LLVM_COV=llvm-cov-12 \
test/run_oss_cpp_tests.sh
+ permissions:
+ contents: read
+ id-token: write
macos:
uses: pytorch/test-infra/.github/workflows/macos_job.yml@release/2.5
with:
release/0.3 — excessive-permissions
File .github/workflows/_unittest.yml; suggested edits:
-
- jobs.$J.permissions.contents = 'read'
-
- jobs.$J.permissions.id-token = 'write'
--- a/.github/workflows/_unittest.yml
+++ b/.github/workflows/_unittest.yml
@@ -43,6 +43,9 @@
LLVM_PROFDATA=llvm-profdata-12 LLVM_COV=llvm-cov-12 \
test/run_oss_cpp_tests.sh
+ permissions:
+ contents: read
+ id-token: write
macos:
uses: pytorch/test-infra/.github/workflows/macos_job.yml@release/2.4
with:
release/0.2 — excessive-permissions
File .github/workflows/_unittest.yml; suggested edits:
-
- jobs.$J.permissions.contents = 'read'
-
- jobs.$J.permissions.id-token = 'write'
--- a/.github/workflows/_unittest.yml
+++ b/.github/workflows/_unittest.yml
@@ -43,6 +43,9 @@
# Run pytest with coverage
pytest -n auto --cov=./ --cov-report=xml
+ permissions:
+ contents: read
+ id-token: write
macos:
uses: pytorch/test-infra/.github/workflows/macos_job.yml@release/2.3
strategy:
Happy to open pull requests instead if that's preferred.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with .github/workflows/_android.yml and .github/workflows/_unittest.yml on each of release/0.5, release/0.4, release/0.3, and release/0.2, comparing them with the default-branch commit 6cce750f. Run zizmor and actionlint for each affected workflow after applying the listed permissions changes; done means the excessive-permissions findings are cleared without new findings.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, yaml
- Domain
- ci-cd, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 75/100