github-starred/ollama
2
0
Fork 0
mirror of https://github.com/ollama/ollama.git synced 2026-05-06 08:02:14 -05:00
Code Issues 14.5k Packages Projects Releases 120 Wiki Activity

[PR #14348] ci: add explicit least-privilege workflow permissions #14635

New Issue
Open
opened 2026-04-13 00:59:39 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-13 00:59:39 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/ollama/ollama/pull/14348
Author: @Rohan5commit
Created: 2/21/2026
Status: 🔄 Open

Base: main ← Head: ci/least-privilege-workflow-permissions

📝 Commits (1)

  • 0dc2cff ci: set explicit least-privilege workflow permissions

📊 Changes

4 files changed (+12 additions, -0 deletions)

View changed files

📝 .github/workflows/latest.yaml (+3 -0)
📝 .github/workflows/release.yaml (+3 -0)
📝 .github/workflows/test-install.yaml (+3 -0)
📝 .github/workflows/test.yaml (+3 -0)

📄 Description

Summary

  • add explicit top-level workflow token permissions (contents: read) to:
    • .github/workflows/test.yaml
    • .github/workflows/test-install.yaml
    • .github/workflows/latest.yaml
    • .github/workflows/release.yaml
  • keep release publishing behavior intact by preserving the existing job-level contents: write override in the release job

Why

These workflows currently inherit repository default GITHUB_TOKEN scope. Setting explicit least-privilege defaults reduces blast radius for CI supply-chain incidents while preserving required release permissions.

Validation

  • rg -n "^permissions:|^\s+contents:\s" .github/workflows/*.yaml
  • inspected release job to confirm existing contents: write remains in place for release publishing

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/ollama/ollama/pull/14348 **Author:** [@Rohan5commit](https://github.com/Rohan5commit) **Created:** 2/21/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `ci/least-privilege-workflow-permissions` --- ### 📝 Commits (1) - [`0dc2cff`](https://github.com/ollama/ollama/commit/0dc2cff48dcfb3013a8ad01888c00f4dfeba4936) ci: set explicit least-privilege workflow permissions ### 📊 Changes **4 files changed** (+12 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/latest.yaml` (+3 -0) 📝 `.github/workflows/release.yaml` (+3 -0) 📝 `.github/workflows/test-install.yaml` (+3 -0) 📝 `.github/workflows/test.yaml` (+3 -0) </details> ### 📄 Description ## Summary - add explicit top-level workflow token permissions (`contents: read`) to: - `.github/workflows/test.yaml` - `.github/workflows/test-install.yaml` - `.github/workflows/latest.yaml` - `.github/workflows/release.yaml` - keep release publishing behavior intact by preserving the existing job-level `contents: write` override in the `release` job ## Why These workflows currently inherit repository default `GITHUB_TOKEN` scope. Setting explicit least-privilege defaults reduces blast radius for CI supply-chain incidents while preserving required release permissions. ## Validation - `rg -n "^permissions:|^\s+contents:\s" .github/workflows/*.yaml` - inspected `release` job to confirm existing `contents: write` remains in place for release publishing --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-13 00:59:39 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
amd
api
app
bug
build
cli
cloud
compatibility
context-length
create
docker
documentation
embeddings
feature request
feedback wanted
good first issue
gpt-oss
gpu
harmony
help wanted
image
install
intel
js
launch
linux
macos
memory
mlx
model
needs more info
networking
nvidia
ollama.com
performance
pull-request
Mirrored from GitHub Pull Request
 python
question
registry
rendering
thinking
tools
top
vulkan
windows
wsl
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/ollama#14635
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?