tektoncd / tektoncd/pipelines-as-code

Backport workflow-hardening fix (excessive-permissions) to 5 release branches

Open Beginner friendly

#2,803 opened on Jun 26, 2026 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

priority/urgent

Dominant language: Go
Stars: 214
Forks: 144
Avg merge: 2d 11h
Merged PRs (30d): 27

Description

Summary

The default branch already hardened .github/workflows/kind-e2e-tests.yaml against the issue(s) below, but 5 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

What's flagged (by zizmor)

excessive-permissions — workflow/job granted broader permissions than needed

Already resolved on the default branch in:

https://github.com/openshift-pipelines/pipelines-as-code/commit/881d94de08735465d21bc8ebdaa7e13ff0d99f5f

Affected release branches (5)

release-v0.27.3 (still present as of HEAD a243e2ab)
release-v0.27.x (still present as of HEAD 29e1a4ae)
release-v0.33.2 (still present as of HEAD 87a0a946)
release-v0.33.x (still present as of HEAD 84011814)
release-v0.33.1 (still present as of HEAD e319414e)

Suggested per-branch patches

Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

release-v0.27.3 — excessive-permissions

File .github/workflows/kind-e2e-tests.yaml; suggested edits:

- permissions.contents = 'read'
- permissions.issues = 'write'
- permissions.pull-requests = 'write'

--- a/.github/workflows/kind-e2e-tests.yaml
+++ b/.github/workflows/kind-e2e-tests.yaml
@@ -119,3 +119,7 @@
           notify_when: "failure"
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write

release-v0.27.x — excessive-permissions

File .github/workflows/kind-e2e-tests.yaml; suggested edits:

- permissions.contents = 'read'
- permissions.issues = 'write'
- permissions.pull-requests = 'write'

--- a/.github/workflows/kind-e2e-tests.yaml
+++ b/.github/workflows/kind-e2e-tests.yaml
@@ -119,3 +119,7 @@
           notify_when: "failure"
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write

release-v0.33.2 — excessive-permissions

File .github/workflows/kind-e2e-tests.yaml; suggested edits:

- permissions.contents = 'read'
- permissions.issues = 'write'
- permissions.pull-requests = 'write'

--- a/.github/workflows/kind-e2e-tests.yaml
+++ b/.github/workflows/kind-e2e-tests.yaml
@@ -133,3 +133,7 @@
           notify_when: "failure"
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write

release-v0.33.x — excessive-permissions

File .github/workflows/kind-e2e-tests.yaml; suggested edits:

- permissions.contents = 'read'
- permissions.issues = 'write'
- permissions.pull-requests = 'write'

--- a/.github/workflows/kind-e2e-tests.yaml
+++ b/.github/workflows/kind-e2e-tests.yaml
@@ -133,3 +133,7 @@
           notify_when: "failure"
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write

release-v0.33.1 — excessive-permissions

File .github/workflows/kind-e2e-tests.yaml; suggested edits:

- permissions.contents = 'read'
- permissions.issues = 'write'
- permissions.pull-requests = 'write'

--- a/.github/workflows/kind-e2e-tests.yaml
+++ b/.github/workflows/kind-e2e-tests.yaml
@@ -133,3 +133,7 @@
           notify_when: "failure"
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write

Happy to open pull requests instead if that's preferred.

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Research direction

Update .github/workflows/kind-e2e-tests.yaml on the five listed release branches, using the shown permissions changes as the scope. Run zizmor and actionlint for each affected branch, and confirm the excessive-permissions finding is cleared without new findings.

Written by the indexing model from the issue text.

Assessment

Tech stack: github-actions
Domain: ci-cd, security
Issue type: Bug
Difficulty: 2/5
Estimated time: 1-3 hours
Activity status: Quiet
Clarity: Clearly specified
Newbie friendliness: 76/100

A short digest of beginner-friendly GitHub issues.