From c5fc707e592f8a51562d1ea3fc9de461cf28e5d6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Wed, 2 Sep 2026 15:47:14 +0200 Subject: [PATCH] ci: scope the dependabot auto-merge write token to its job The workflow granted contents: write and pull-requests: write at the top level, so every step in the run held them, including the checkout and the dependency install that execute code from the pull request being merged. Scorecard flags the shape, and the shape is the problem: a compromised transitive in a Dependabot branch would run with a token that can write to the repository. The workflow default is contents: read now, and the two write scopes sit on the auto-merge job, which is the only job there is and the only place they are spent. gh pr merge --auto needs contents: write to enable merge-on-green and pull-requests: write to act on the pull request; the major-bump comment needs pull-requests: write. The metadata fetch and the test run need neither. Nothing about which updates merge automatically changes. --- .github/workflows/dependabot-auto-merge.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 7a399726d..7995cc21f 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -2,14 +2,20 @@ name: Auto-merge Dependabot on: pull_request +# Nothing outside the one job needs more than a checkout, so the default for +# the workflow is read-only and the write scopes sit on the job that spends +# them: `gh pr merge --auto` writes to the repository's merge queue state, and +# both the merge and the review comment write to the pull request. permissions: - contents: write - pull-requests: write + contents: read jobs: auto-merge: runs-on: ubuntu-latest if: github.actor == 'dependabot[bot]' + permissions: + contents: write + pull-requests: write steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1