Repository navigation
Review the GitHub Actions workflows for least-privilege token permissions #114
Description
While reviewing #113, I noticed that the eps1lon/actions-label-merge-conflict action started recommending setting explicit permissions as of its v3.1.0 release (eps1lon/actions-label-merge-conflict#151), which this repository does not currently do. It occurred to me that there might be some opportunities to improve the permissions of the other workflows as well.
Currently, only the pr-comment and publish-wiki workflows declare an explicit permissions block, and they do so only at the job level. The remaining workflows (basic-qa, label-merge-conflicts, label-new-prs, and label-remove-outdated) rely on the default token permissions, which can be broader than what each job actually needs.
Opening this issue to suggest reviewing the permissions across all workflows and adopting a least-privilege pattern. Maybe we could add a top-level permissions: {} block in each workflow file that grants no permissions by default, with each job declaring only the specific permissions it needs (inspired by https://developer.wordpress.org/coding-standards/wordpress-coding-standards/github-actions/#excessive-permissions).
While we are at it, I wonder if it would be a good idea to add a tool like Zizmor and/or Actionlint to the CI. They could catch this kind of issue (and other workflow security and correctness problems) automatically, instead of relying on a manual review.
Activity
jrfnl commentedon Oct 18, 2026
This has now been addressed via PR #125.
Note: please link to authoritative sources, so https://docs.zizmor.sh/audits/#excessive-permissions not some ripped off copy of that text in the WP docs.
Actionlint is already being run via the reusable-yamllint workflow., though that doesn't catch this kind of problem (though it catches other useful things).
Zizmor does catch it, but is also a little too opiniated IMO for running in CI, especially as new opinionated checks are being added regularly, which would make this a frequent cause of CI failure. Worth keeping an eye on though, might be an option at a later time.