richardcase / richardcase/clowder
Restrict Pages and OIDC permissions to the deploy job
Open
Nobody has claimed this yet.
github_actions
priority: medium
- Dominant language
- Rust
- Stars
- 0
- Forks
- 0
- Avg merge
- 1h 14m
- Merged PRs (30d)
- 16
Description
Problem
The Pages deployment workflow grants pages: write and id-token: write at workflow scope, including the source-controlled build job that runs npm hooks and a third-party Astro Action.
Evidence: https://github.com/richardcase/clowder/blob/b5492d5/.github/workflows/deploy-site.yml#L30-L65
Acceptance criteria
- Give
buildonly the permissions required for checkout/build. - Grant Pages/OIDC permissions only to
deploy. - Verify the deployment still succeeds and add an actionlint check for the intended scope.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with .github/workflows/deploy-site.yml at lines 30-65 and inspect the current workflow-level permissions and build/deploy jobs. Run actionlint after scoping permissions, then verify the Pages deployment still succeeds. Done means build has only checkout/build permissions, while deploy alone has Pages and OIDC permissions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions
- Domain
- ci-cd, security
- Issue type
- Refactor
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100