CI: Explicitly define CI workflow permissions#31238
Merged
ksunden merged 1 commit intomatplotlib:mainfrom Mar 6, 2026
Merged
Conversation
Member
Is this a security gain? I just checke cibuildwheel.yml, and there you removed the global read permission but re-added it in all (both) jobs. https://scientific-python.org/specs/spec-0008/#hardening-workflow-environment-permissions suggests to globally set read permissions. Semi-OT: Where do we stand on https://scientific-python.org/specs/spec-0008/? |
Contributor
Author
|
It's not a functional/security change for the files which already defined global permissions. It's more of a defensive pattern in those cases, if additional jobs get added to those files or those jobs get pasted into other places. |
timhoffm
approved these changes
Mar 6, 2026
ksunden
approved these changes
Mar 6, 2026
andreas16700
added a commit
to andreas16700/matplotlib
that referenced
this pull request
Mar 16, 2026
…ci_permissions
andreas16700
added a commit
to andreas16700/matplotlib
that referenced
this pull request
Mar 16, 2026
…ci_permissions
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR summary
Inspired by the recent CI attacks here: https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation#summary-of-results
This tightens up permissions on CI runners by zeroing out permissions to start, and adding them back in per-job. I would characterize this as low priority hardening.
AI Disclosure
PR checklist