stacklok / stacklok/releaseo

Document minimum required token permissions

Open
#10 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

documentation security
Dominant language
Go
Stars
0
Forks
0
Avg merge
3d 6h
Merged PRs (30d)
4

Description

Summary

Document the minimum required GitHub token permissions for using this action.

Background

From the security threat model (T5: Token Exposure), users should understand exactly what permissions are needed to reduce blast radius if credentials are compromised.

Acceptance Criteria

  • Add a section to README.md documenting minimum token permissions
  • Include example workflow snippet with explicit permissions block
  • Explain the purpose of each permission:
    • contents: write - Create branches and commits
    • pull-requests: write - Create pull requests
    • issues: write - Add labels to PRs (optional)
  • Recommend fine-grained PATs or GitHub App tokens over GITHUB_TOKEN where possible

Priority

High - Security documentation

Related

  • SECURITY.md threat model (T5)

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with README.md and the related SECURITY.md threat model section T5: Token Exposure. Add the minimum token permissions, an example workflow with an explicit permissions block, explanations for each permission, and guidance on fine-grained PATs or GitHub App tokens. Done means all listed acceptance criteria are documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions
Domain
documentation, security
Issue type
Documentation
Difficulty
1/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.