This is an automated email from the ASF dual-hosted git repository.
apupier pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel-quarkus.git
The following commit(s) were added to refs/heads/main by this push:
new 69538c65ee Fixes #9059. Declare least-privilege permissions on the
cron workflows
69538c65ee is described below
commit 69538c65ee345ea35bb7c02e3899e5fa996ddad9
Author: Andrea Cosentino <[email protected]>
AuthorDate: Wed Aug 26 09:30:50 2026 +0200
Fixes #9059. Declare least-privilege permissions on the cron workflows
Neither camel-master-cron.yaml nor quarkus-master-cron.yaml declared a
permissions block, so every job ran with the repository default token scope
while building code cloned from another repository.
Add a top-level `contents: read` and scope each job to what it actually
needs. Every job reports build status through the build-notification
profile,
which reopens, comments on and closes the tracking issue, so each carries
`issues: write`. handle-build-status additionally pushes the synced branch,
so it carries `contents: write`.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
---
.github/workflows/camel-master-cron.yaml | 24 ++++++++++++++++++++++++
.github/workflows/quarkus-master-cron.yaml | 24 ++++++++++++++++++++++++
2 files changed, 48 insertions(+)
diff --git a/.github/workflows/camel-master-cron.yaml
b/.github/workflows/camel-master-cron.yaml
index 3d16d22cc4..e673c0cfba 100644
--- a/.github/workflows/camel-master-cron.yaml
+++ b/.github/workflows/camel-master-cron.yaml
@@ -30,8 +30,14 @@ env:
ISSUE_ID: 2927
DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+permissions:
+ contents: read
+
jobs:
initial-mvn-install:
+ permissions:
+ contents: read
+ issues: write
if: github.repository == 'apache/camel-quarkus'
runs-on: ubuntu-latest
outputs:
@@ -138,6 +144,9 @@ jobs:
./mvnw ${CQ_MAVEN_ARGS} verify -N -Pbuild-notification -Dstatus=${{
job.status }} -DissueId=${{ env.ISSUE_ID }} -Dtoken=${{ secrets.GITHUB_TOKEN }}
-DbuildId=$(cat ~/build-data/build-id.txt) -Drepo=${GITHUB_REPOSITORY}
-Dbranch=camel-main -Dbranch-commit=$(cat ~/build-data/main-sha.txt)
native-tests:
+ permissions:
+ contents: read
+ issues: write
name: Native Tests - ${{matrix.category}}
needs: initial-mvn-install
runs-on: ubuntu-latest
@@ -220,6 +229,9 @@ jobs:
./mvnw ${CQ_MAVEN_ARGS} verify -N -Pbuild-notification -Dstatus=${{
job.status }} -DissueId=${{ env.ISSUE_ID }} -Dtoken=${{ secrets.GITHUB_TOKEN }}
-DbuildId=$(cat ~/build-data/build-id.txt) -Drepo=${GITHUB_REPOSITORY}
-Dbranch=camel-main -Dbranch-commit=$(cat ~/build-data/main-sha.txt)
functional-extension-tests:
+ permissions:
+ contents: read
+ issues: write
runs-on: ubuntu-latest
needs: initial-mvn-install
env:
@@ -311,6 +323,9 @@ jobs:
./mvnw ${CQ_MAVEN_ARGS} verify -N -Pbuild-notification -Dstatus=${{
job.status }} -DissueId=${{ env.ISSUE_ID }} -Dtoken=${{ secrets.GITHUB_TOKEN }}
-DbuildId=$(cat ~/build-data/build-id.txt) -Drepo=${GITHUB_REPOSITORY}
-Dbranch=camel-main -Dbranch-commit=$(cat ~/build-data/main-sha.txt)
integration-tests-jvm:
+ permissions:
+ contents: read
+ issues: write
runs-on: ubuntu-latest
needs: initial-mvn-install
env:
@@ -355,6 +370,9 @@ jobs:
./mvnw ${CQ_MAVEN_ARGS} verify -N -Pbuild-notification -Dstatus=${{
job.status }} -DissueId=${{ env.ISSUE_ID }} -Dtoken=${{ secrets.GITHUB_TOKEN }}
-DbuildId=$(cat ~/build-data/build-id.txt) -Drepo=${GITHUB_REPOSITORY}
-Dbranch=camel-main -Dbranch-commit=$(cat ~/build-data/main-sha.txt)
integration-tests-alternative-platform:
+ permissions:
+ contents: read
+ issues: write
runs-on: ${{ matrix.os }}
needs: initial-mvn-install
strategy:
@@ -405,6 +423,9 @@ jobs:
./mvnw ${CQ_MAVEN_ARGS} verify -N -Pbuild-notification -Dstatus=${{
job.status }} -DissueId=${{ env.ISSUE_ID }} -Dtoken=${{ secrets.GITHUB_TOKEN }}
-DbuildId=$(cat ~/build-data/build-id.txt) -Drepo=${GITHUB_REPOSITORY}
-Dbranch=camel-main -Dbranch-commit=$(cat ~/build-data/main-sha.txt)
examples-tests:
+ permissions:
+ contents: read
+ issues: write
name: Examples Tests - ${{matrix.name}}
needs: initial-mvn-install
runs-on: ubuntu-latest
@@ -487,6 +508,9 @@ jobs:
./mvnw ${CQ_MAVEN_ARGS} verify -N -Pbuild-notification -Dstatus=${{
job.status }} -DissueId=${{ env.ISSUE_ID }} -Dtoken=${{ secrets.GITHUB_TOKEN }}
-DbuildId=$(cat ~/build-data/build-id.txt) -Drepo=${GITHUB_REPOSITORY}
-Dbranch=camel-main -Dbranch-commit=$(cat ~/build-data/main-sha.txt)
handle-build-status:
+ permissions:
+ contents: write
+ issues: write
needs: native-tests
runs-on: ubuntu-latest
steps:
diff --git a/.github/workflows/quarkus-master-cron.yaml
b/.github/workflows/quarkus-master-cron.yaml
index 82c1c64ace..60c315c4c2 100644
--- a/.github/workflows/quarkus-master-cron.yaml
+++ b/.github/workflows/quarkus-master-cron.yaml
@@ -30,8 +30,14 @@ env:
ISSUE_ID: 2926
DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+permissions:
+ contents: read
+
jobs:
initial-mvn-install:
+ permissions:
+ contents: read
+ issues: write
if: github.repository == 'apache/camel-quarkus'
runs-on: ubuntu-latest
outputs:
@@ -140,6 +146,9 @@ jobs:
./mvnw ${CQ_MAVEN_ARGS} verify -N -Pbuild-notification -Dstatus=${{
job.status }} -DissueId=${{ env.ISSUE_ID }} -Dtoken=${{ secrets.GITHUB_TOKEN }}
-DbuildId=$(cat ~/build-data/build-id.txt) -Drepo=${GITHUB_REPOSITORY}
-Dbranch=quarkus-main -Dbranch-commit=$(cat ~/build-data/main-sha.txt)
native-tests:
+ permissions:
+ contents: read
+ issues: write
name: Native Tests - ${{matrix.category}}
needs: initial-mvn-install
runs-on: ubuntu-latest
@@ -222,6 +231,9 @@ jobs:
./mvnw ${CQ_MAVEN_ARGS} verify -N -Pbuild-notification -Dstatus=${{
job.status }} -DissueId=${{ env.ISSUE_ID }} -Dtoken=${{ secrets.GITHUB_TOKEN }}
-DbuildId=$(cat ~/build-data/build-id.txt) -Drepo=${GITHUB_REPOSITORY}
-Dbranch=quarkus-main -Dbranch-commit=$(cat ~/build-data/main-sha.txt)
functional-extension-tests:
+ permissions:
+ contents: read
+ issues: write
runs-on: ubuntu-latest
needs: initial-mvn-install
env:
@@ -313,6 +325,9 @@ jobs:
./mvnw ${CQ_MAVEN_ARGS} verify -N -Pbuild-notification -Dstatus=${{
job.status }} -DissueId=${{ env.ISSUE_ID }} -Dtoken=${{ secrets.GITHUB_TOKEN }}
-DbuildId=$(cat ~/build-data/build-id.txt) -Drepo=${GITHUB_REPOSITORY}
-Dbranch=quarkus-main -Dbranch-commit=$(cat ~/build-data/main-sha.txt)
integration-tests-jvm:
+ permissions:
+ contents: read
+ issues: write
runs-on: ubuntu-latest
needs: initial-mvn-install
env:
@@ -357,6 +372,9 @@ jobs:
./mvnw ${CQ_MAVEN_ARGS} verify -N -Pbuild-notification -Dstatus=${{
job.status }} -DissueId=${{ env.ISSUE_ID }} -Dtoken=${{ secrets.GITHUB_TOKEN }}
-DbuildId=$(cat ~/build-data/build-id.txt) -Drepo=${GITHUB_REPOSITORY}
-Dbranch=quarkus-main -Dbranch-commit=$(cat ~/build-data/main-sha.txt)
integration-tests-alternative-platform:
+ permissions:
+ contents: read
+ issues: write
runs-on: ${{ matrix.os }}
needs: initial-mvn-install
strategy:
@@ -407,6 +425,9 @@ jobs:
./mvnw ${CQ_MAVEN_ARGS} verify -N -Pbuild-notification -Dstatus=${{
job.status }} -DissueId=${{ env.ISSUE_ID }} -Dtoken=${{ secrets.GITHUB_TOKEN }}
-DbuildId=$(cat ~/build-data/build-id.txt) -Drepo=${GITHUB_REPOSITORY}
-Dbranch=quarkus-main -Dbranch-commit=$(cat ~/build-data/main-sha.txt)
examples-tests:
+ permissions:
+ contents: read
+ issues: write
name: Examples Tests - ${{matrix.name}}
needs: initial-mvn-install
runs-on: ubuntu-latest
@@ -489,6 +510,9 @@ jobs:
./mvnw ${CQ_MAVEN_ARGS} verify -N -Pbuild-notification -Dstatus=${{
job.status }} -DissueId=${{ env.ISSUE_ID }} -Dtoken=${{ secrets.GITHUB_TOKEN }}
-DbuildId=$(cat ~/build-data/build-id.txt) -Drepo=${GITHUB_REPOSITORY}
-Dbranch=quarkus-main -Dbranch-commit=$(cat ~/build-data/main-sha.txt)
handle-build-status:
+ permissions:
+ contents: write
+ issues: write
needs: native-tests
runs-on: ubuntu-latest
steps:
