You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spark.apache.org by do...@apache.org on 2026/07/23 22:21:40 UTC
(spark-kubernetes-operator) branch main updated: [SPARK-58303] Declare least-privilege `permissions` in GitHub Actions workflows
This is an automated email from the ASF dual-hosted git repository.
dongjoon-hyun pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/spark-kubernetes-operator.git
The following commit(s) were added to refs/heads/main by this push:
new e47af1a [SPARK-58303] Declare least-privilege `permissions` in GitHub Actions workflows
e47af1a is described below
commit e47af1a2d438faf45cadb391193b30ee152c41d0
Author: Dongjoon Hyun <do...@apache.org>
AuthorDate: Thu Jul 23 15:21:33 2026 -0700
[SPARK-58303] Declare least-privilege `permissions` in GitHub Actions workflows
### What changes were proposed in this pull request?
This PR aims to declare least-privilege `permissions: contents: read` in the four GitHub Actions workflows that did not declare any token permissions: `build_and_test.yml`, `build_main.yml`, `publish_snapshot_chart.yml`, and `publish_snapshot_dockerhub.yml`. The other workflows already declare job-level permissions.
### Why are the changes needed?
Without an explicit `permissions` block, workflows run with the default `GITHUB_TOKEN` permissions, which are broader than needed. These workflows only read via `GITHUB_TOKEN`; publishing uses dedicated secrets.
### Does this PR introduce _any_ user-facing change?
No.
### How was this patch tested?
Pass the CIs.
### Was this patch authored or co-authored using generative AI tooling?
Generated-by: Claude Fable 5
Closes #771 from dongjoon-hyun/SPARK-58303.
Authored-by: Dongjoon Hyun <do...@apache.org>
Signed-off-by: Dongjoon Hyun <do...@apache.org>
---
.github/workflows/build_and_test.yml | 3 +++
.github/workflows/build_main.yml | 3 +++
.github/workflows/publish_snapshot_chart.yml | 3 +++
.github/workflows/publish_snapshot_dockerhub.yml | 3 +++
4 files changed, 12 insertions(+)
diff --git a/.github/workflows/build_and_test.yml b/.github/workflows/build_and_test.yml
index ef9ca7d..ef22cb2 100644
--- a/.github/workflows/build_and_test.yml
+++ b/.github/workflows/build_and_test.yml
@@ -3,6 +3,9 @@ name: Build and test
on:
workflow_call:
+permissions:
+ contents: read
+
jobs:
license-check:
name: "License Check"
diff --git a/.github/workflows/build_main.yml b/.github/workflows/build_main.yml
index 04a1da7..be1e441 100644
--- a/.github/workflows/build_main.yml
+++ b/.github/workflows/build_main.yml
@@ -29,6 +29,9 @@ concurrency:
group: ${{ github.workflow }}-${{ github.ref }}${{ github.ref == 'refs/heads/main' && format('-{0}', github.sha) || '' }}
cancel-in-progress: true
+permissions:
+ contents: read
+
jobs:
call-build-and-test:
name: Run
diff --git a/.github/workflows/publish_snapshot_chart.yml b/.github/workflows/publish_snapshot_chart.yml
index b5a537e..eae15d4 100644
--- a/.github/workflows/publish_snapshot_chart.yml
+++ b/.github/workflows/publish_snapshot_chart.yml
@@ -12,6 +12,9 @@ on:
# keep in sync with default value of strategy matrix 'branch'
default: '["main"]'
+permissions:
+ contents: read
+
jobs:
publish-snapshot-chart:
if: ${{ startsWith(github.repository, 'apache/') }}
diff --git a/.github/workflows/publish_snapshot_dockerhub.yml b/.github/workflows/publish_snapshot_dockerhub.yml
index 4ff22c9..a34348a 100644
--- a/.github/workflows/publish_snapshot_dockerhub.yml
+++ b/.github/workflows/publish_snapshot_dockerhub.yml
@@ -12,6 +12,9 @@ on:
# keep in sync with default value of strategy matrix 'branch'
default: '["main"]'
+permissions:
+ contents: read
+
jobs:
publish-snapshot-image:
if: ${{ startsWith(github.repository, 'apache/') }}
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@spark.apache.org
For additional commands, e-mail: commits-help@spark.apache.org