(superset) branch fix/zizmor-excessive-permissions created (now c6b174b960a)

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a change to branch fix/zizmor-excessive-permissions
in repository https://gitbox.apache.org/repos/asf/superset.git


      at c6b174b960a chore(ci): set least-privilege workflow permissions (zizmor)

This branch includes the following new commits:

     new c6b174b960a chore(ci): set least-privilege workflow permissions (zizmor)

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.

(superset) 01/01: chore(ci): set least-privilege workflow permissions (zizmor)

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a commit to branch fix/zizmor-excessive-permissions
in repository https://gitbox.apache.org/repos/asf/superset.git

commit c6b174b960a51a6c0934b49e346d8eb91761e6d1
Author: Evan <ev...@preset.io>
AuthorDate: Wed Jun 17 09:27:21 2026 -0700

    chore(ci): set least-privilege workflow permissions (zizmor)
    
    Add an explicit top-level `permissions: contents: read` block to the
    Python unit-test and integration-test workflows. Both previously omitted
    a workflow-level permissions block, so jobs inherited the broad default
    GITHUB_TOKEN scope, which zizmor flags as excessive-permissions.
    
    The result-check anchor jobs (unit-tests-required / test-postgres-required)
    only inspect a job result and need no token scope; they now inherit the
    restrictive default. Jobs that need more (codecov OIDC, change detection)
    already declare their own job-level permissions blocks, so behavior is
    unchanged.
    
    Resolves code-scanning alerts #2527, #2528, #2529, #2530
    (zizmor excessive-permissions).
    
    Co-Authored-By: Claude Opus 4.8 <no...@anthropic.com>
---
 .github/workflows/superset-python-integrationtest.yml | 5 +++++
 .github/workflows/superset-python-unittest.yml        | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/.github/workflows/superset-python-integrationtest.yml b/.github/workflows/superset-python-integrationtest.yml
index d57b300659e..92e2dc58954 100644
--- a/.github/workflows/superset-python-integrationtest.yml
+++ b/.github/workflows/superset-python-integrationtest.yml
@@ -1,6 +1,11 @@
 # Python integration tests
 name: Python-Integration
 
+# Least-privilege default for GITHUB_TOKEN. Jobs that need more (e.g. OIDC for
+# codecov uploads) opt in via their own job-level `permissions:` block.
+permissions:
+  contents: read
+
 on:
   push:
     branches:
diff --git a/.github/workflows/superset-python-unittest.yml b/.github/workflows/superset-python-unittest.yml
index 7355005eb55..be18420bcba 100644
--- a/.github/workflows/superset-python-unittest.yml
+++ b/.github/workflows/superset-python-unittest.yml
@@ -1,6 +1,11 @@
 # Python unit tests
 name: Python-Unit
 
+# Least-privilege default for GITHUB_TOKEN. Jobs that need more (e.g. OIDC for
+# codecov uploads) opt in via their own job-level `permissions:` block.
+permissions:
+  contents: read
+
 on:
   push:
     branches: