mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-07 04:12:04 +00:00
Marc-André Bombeck
c5fc707e59
The workflow granted contents: write and pull-requests: write at the top level, so every step in the run held them, including the checkout and the dependency install that execute code from the pull request being merged. Scorecard flags the shape, and the shape is the problem: a compromised transitive in a Dependabot branch would run with a token that can write to the repository. The workflow default is contents: read now, and the two write scopes sit on the auto-merge job, which is the only job there is and the only place they are spent. gh pr merge --auto needs contents: write to enable merge-on-green and pull-requests: write to act on the pull request; the major-bump comment needs pull-requests: write. The metadata fetch and the test run need neither. Nothing about which updates merge automatically changes.