oscerd opened a new issue, #136:
URL: https://github.com/apache/camel-kit/issues/136
## Description
`.github/workflows/build.yml` declares no top-level `permissions:` block, so
every job inherits the repository-default token scope. The `build` job needs
only `contents: read`, and `comment-pr` already scopes `pull-requests: write`
at the job level. Declaring an explicit least-privilege default hardens the
workflow if a compromised action tries to use the ambient token.
Secondary: `build` runs `actions/setup-java` with `cache: maven` on
`pull_request`. This is **not** exploitable (GitHub isolates fork-PR cache
scopes and the build job writes nothing with the token), but an explicit
top-level `permissions` is the standard mitigation for zizmor's
`excessive-permissions`/`cache-poisoning` advisories.
## Proposed change
Add at the top of `.github/workflows/build.yml`:
```yaml
permissions:
contents: read
```
The `comment-pr` job keeps its own `permissions: { pull-requests: write }`.
## Notes
Hardening / defense-in-depth, **not a vulnerability**. Found during a
security review of the repository.
_AI-generated by Claude Code (Claude Opus 4.8) on behalf of @oscerd._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
