CICD: Restrict permissions in .github/workflows/pr_build.yml (#4121)

tlimoncelli · github-advanced-security[bot] · web-flow · commit 63ba7d9735e1 · 2026-03-02T12:29:47.000-05:00
Potential fix for [https://github.com/StackExchange/dnscontrol/security/code-scanning/36](https://github.com/StackExchange/dnscontrol/security/code-scanning/36) In general, the fix is to explicitly define `permissions` for the `GITHUB_TOKEN` in the workflow, restricting it to the least privileges needed. Since this workflow only checks out code, uses caches, runs tests, uploads artifacts, and runs GoReleaser builds without creating releases or pushing tags, it should only require read access to repository contents. The best way to fix this without changing existing functionality is to add a `permissions` block near the top of the workflow (at the root level, alongside `name`, `on`, and `env`). This will apply to all jobs that do not override `permissions`. We should set `contents: read`, which matches the minimal recommendation in the CodeQL message and is sufficient for `actions/checkout` and other used actions. No additional scopes (like `pull-requests: write` or `packages: write`) appear necessary based on the provided snippet. Concretely, in `.github/workflows/pr_build.yml`, after the `on:` block (lines 6–15) and before the `env:` block (line 18), insert: ```yaml permissions: contents: read ``` No imports or additional definitions are needed; this is purely a YAML configuration change. _Suggested fixes powered by Copilot Autofix. Review carefully before merging._ Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
diff --git a/.github/workflows/pr_build.yml b/.github/workflows/pr_build.yml
@@ -14,6 +14,9 @@ on:
     branches:
       - 'tlim_testpr'
 
+permissions:
+  contents: read
+
 # Environment Variables
 env:
   # cache-key: Change to force cache reset `pwsh > Get-Date -UFormat %s`
