You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by "arpitjain099 (via GitHub)" <gi...@apache.org> on 2026/05/31 01:12:14 UTC
[PR] ci: declare least-privilege workflow-level contents: read [camel]
arpitjain099 opened a new pull request, #23653:
URL: https://github.com/apache/camel/pull/23653
Hardens 3 workflow(s) in this repo by declaring a workflow-level `permissions: contents: read`. Today those workflows inherit the legacy broad read-write GITHUB_TOKEN; the read-only default reduces blast radius if any step is compromised.
I checked each file - they read the checkout and run tests/lints; no GitHub API writes (no `gh pr/issue`, no `git push`, no release/publish/comment actions). So behavior is unchanged.
Reference: the tj-actions/changed-files compromise (CVE-2025-30066) is the canonical reason to apply least-privilege defaults.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: declare least-privilege workflow-level contents: read [camel]
Posted by "arpitjain099 (via GitHub)" <gi...@apache.org>.
arpitjain099 commented on code in PR #23653:
URL: https://github.com/apache/camel/pull/23653#discussion_r3330237418
##########
.github/workflows/pr-commenter.yml:
##########
@@ -24,6 +24,10 @@ on:
types:
- completed
+
+permissions:
+ contents: read
Review Comment:
Good catch, fixed. Confirmed against the file: the artifact download (github.rest.actions.downloadArtifact) needs actions: read and the welcome comment (github.rest.issues.createComment) needs pull-requests: write, so I added both alongside contents: read. Pushed in 9e5fe87.
##########
.github/workflows/pr-labeler.yml:
##########
@@ -24,6 +24,10 @@ on:
types:
- completed
+
+permissions:
+ contents: read
Review Comment:
Done. actions/labeler writes labels so it needs pull-requests: write, and the artifact download needs actions: read. Updated this one to contents: read + pull-requests: write + actions: read in 9e5fe87. Left pr-id.yml at contents: read on its own since it only checks out and uploads an artifact.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: declare least-privilege workflow-level contents: read [camel]
Posted by "arpitjain099 (via GitHub)" <gi...@apache.org>.
arpitjain099 commented on code in PR #23653:
URL: https://github.com/apache/camel/pull/23653#discussion_r3330237418
##########
.github/workflows/pr-commenter.yml:
##########
@@ -24,6 +24,10 @@ on:
types:
- completed
+
+permissions:
+ contents: read
Review Comment:
Good catch, fixed. Confirmed against the file: the artifact download (github.rest.actions.downloadArtifact) needs actions: read and the welcome comment (github.rest.issues.createComment) needs pull-requests: write, so I added both alongside contents: read. Pushed in ce864c0.
##########
.github/workflows/pr-labeler.yml:
##########
@@ -24,6 +24,10 @@ on:
types:
- completed
+
+permissions:
+ contents: read
Review Comment:
Done. actions/labeler writes labels so it needs pull-requests: write, and the artifact download needs actions: read. Updated this one to contents: read + pull-requests: write + actions: read in ce864c0. Left pr-id.yml at contents: read on its own since it only checks out and uploads an artifact.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: declare least-privilege workflow-level contents: read [camel]
Posted by "davsclaus (via GitHub)" <gi...@apache.org>.
davsclaus commented on code in PR #23653:
URL: https://github.com/apache/camel/pull/23653#discussion_r3329915099
##########
.github/workflows/pr-labeler.yml:
##########
@@ -24,6 +24,10 @@ on:
types:
- completed
+
+permissions:
+ contents: read
Review Comment:
This workflow uses `actions/labeler` (line 67) to add labels to PRs, and downloads artifacts via the Actions API. Both need permissions beyond `contents: read`.
```suggestion
permissions:
contents: read
pull-requests: write
actions: read
```
##########
.github/workflows/pr-commenter.yml:
##########
@@ -24,6 +24,10 @@ on:
types:
- completed
+
+permissions:
+ contents: read
Review Comment:
This workflow calls `github.rest.issues.createComment()` (line 87) to write a welcome comment on PRs, and uses the Actions API to download artifacts. With only `contents: read` declared, `pull-requests` and `actions` permissions default to `none`, breaking both operations.
```suggestion
permissions:
contents: read
pull-requests: write
actions: read
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: declare least-privilege workflow-level contents: read [camel]
Posted by "arpitjain099 (via GitHub)" <gi...@apache.org>.
arpitjain099 commented on code in PR #23653:
URL: https://github.com/apache/camel/pull/23653#discussion_r3330237418
##########
.github/workflows/pr-commenter.yml:
##########
@@ -24,6 +24,10 @@ on:
types:
- completed
+
+permissions:
+ contents: read
Review Comment:
Good catch, fixed. Confirmed against the file: the artifact download (github.rest.actions.downloadArtifact) needs actions: read and the welcome comment (github.rest.issues.createComment) needs pull-requests: write, so I added both alongside contents: read. Pushed in 96d7c87.
##########
.github/workflows/pr-labeler.yml:
##########
@@ -24,6 +24,10 @@ on:
types:
- completed
+
+permissions:
+ contents: read
Review Comment:
Done. actions/labeler writes labels so it needs pull-requests: write, and the artifact download needs actions: read. Updated this one to contents: read + pull-requests: write + actions: read in 96d7c87. Left pr-id.yml at contents: read on its own since it only checks out and uploads an artifact.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: declare least-privilege workflow-level contents: read [camel]
Posted by "arpitjain099 (via GitHub)" <gi...@apache.org>.
arpitjain099 commented on code in PR #23653:
URL: https://github.com/apache/camel/pull/23653#discussion_r3330237418
##########
.github/workflows/pr-commenter.yml:
##########
@@ -24,6 +24,10 @@ on:
types:
- completed
+
+permissions:
+ contents: read
Review Comment:
Good catch, fixed. Confirmed against the file: the artifact download (github.rest.actions.downloadArtifact) needs actions: read and the welcome comment (github.rest.issues.createComment) needs pull-requests: write, so I added both alongside contents: read.
##########
.github/workflows/pr-labeler.yml:
##########
@@ -24,6 +24,10 @@ on:
types:
- completed
+
+permissions:
+ contents: read
Review Comment:
Done. actions/labeler writes labels so it needs pull-requests: write, and the artifact download needs actions: read. Updated this one to contents: read + pull-requests: write + actions: read. Left pr-id.yml at contents: read on its own since it only checks out and uploads an artifact.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: declare least-privilege workflow-level contents: read [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #23653:
URL: https://github.com/apache/camel/pull/23653#issuecomment-4587854374
:star2: Thank you for your contribution to the Apache Camel project! :star2:
:robot: CI automation will test this PR automatically.
:camel: Apache Camel Committers, please review the following items:
* First-time contributors **require MANUAL approval** for the GitHub Actions to run
* You can use the command `/component-test (camel-)component-name1 (camel-)component-name2..` to request a test from the test bot although they are normally detected and executed by CI.
* You can label PRs using `skip-tests` and `test-dependents` to fine-tune the checks executed by this PR.
* Build and test logs are available in the summary page. **Only** [Apache Camel committers](https://camel.apache.org/community/team/#committers) have access to the summary.
:warning: Be careful when sharing logs. Review their contents before sharing them publicly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ci: declare least-privilege workflow-level contents: read [camel]
Posted by "apupier (via GitHub)" <gi...@apache.org>.
apupier merged PR #23653:
URL: https://github.com/apache/camel/pull/23653
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org