[PR #21688] [CLOSED] ci: declare explicit least-privilege GITHUB_TOKEN permissions #97244

New Issue

2026-05-15T23:40:06-05:00

GiteaMirror commented

2026-05-15 23:40:06 -05:00

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/21688
Author: @Rohan5commit
Created: 2/21/2026
Status: ❌ Closed

Base: main ← Head: ci/explicit-workflow-token-permissions

📝 Commits (1)

3b76e95 ci: declare explicit least-privilege workflow token permissions

📊 Changes

4 files changed (+10 additions, -0 deletions)

View changed files

📝 .github/workflows/deploy-to-hf-spaces.yml (+3 -0)
📝 .github/workflows/format-backend.yaml (+3 -0)
📝 .github/workflows/format-build-frontend.yaml (+3 -0)
📝 .github/workflows/release-pypi.yml (+1 -0)

📄 Description

Summary\n- add explicit top-level `permissions: contents: read` to deploy and CI formatting workflows\n- add `contents: read` to the PyPI release job permissions alongside existing `id-token: write`\n\n## Why\nThese workflows currently rely on implicit/default token scopes in places. Explicitly declaring the minimum required permissions improves security posture and makes workflow intent clear.\n\n## Changed files\n- `.github/workflows/deploy-to-hf-spaces.yml`\n- `.github/workflows/format-backend.yaml`\n- `.github/workflows/format-build-frontend.yaml`\n- `.github/workflows/release-pypi.yml`\n\n## Notes\n- configuration-only change; no build/test logic modified\n

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/21688 **Author:** [@Rohan5commit](https://github.com/Rohan5commit) **Created:** 2/21/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `ci/explicit-workflow-token-permissions` --- ### 📝 Commits (1) - [`3b76e95`](https://github.com/open-webui/open-webui/commit/3b76e95f8801facf7837aa41f3e9c792fbd9768f) ci: declare explicit least-privilege workflow token permissions ### 📊 Changes **4 files changed** (+10 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/deploy-to-hf-spaces.yml` (+3 -0) 📝 `.github/workflows/format-backend.yaml` (+3 -0) 📝 `.github/workflows/format-build-frontend.yaml` (+3 -0) 📝 `.github/workflows/release-pypi.yml` (+1 -0) </details> ### 📄 Description ## Summary\n- add explicit top-level `permissions: contents: read` to deploy and CI formatting workflows\n- add `contents: read` to the PyPI release job permissions alongside existing `id-token: write`\n\n## Why\nThese workflows currently rely on implicit/default token scopes in places. Explicitly declaring the minimum required permissions improves security posture and makes workflow intent clear.\n\n## Changed files\n- `.github/workflows/deploy-to-hf-spaces.yml`\n- `.github/workflows/format-backend.yaml`\n- `.github/workflows/format-build-frontend.yaml`\n- `.github/workflows/release-pypi.yml`\n\n## Notes\n- configuration-only change; no build/test logic modified\n --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-05-15 23:40:06 -05:00

GiteaMirror closed this issue

2026-05-15 23:40:09 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#97244