Repository navigation
.github: least-privilege permissions for docker/hive/kurtosis workflows (#21132) - #22687
Merged
AskAlexSharov merged 1 commit intoJul 23, 2026
Merged
Conversation
…kflows Add explicit permissions blocks instead of the broad default token: - ci-cd-main-branch-docker-images, qa-txpool-performance-test: contents: read (DockerHub only — auth via DockerHub secrets, no GitHub token used). - test-hive, test-hive-eest: contents: read + actions: write (merge-queue self-cancel via gh run cancel; DockerHub pull needs no GitHub permission). - test-kurtosis-assertoor: top-level contents: read, with actions: write scoped to the assertoor_test job that runs gh run cancel. The image build uses load: true (no registry push) so no packages permission is needed. Part of the #21132 excessive-permissions cleanup.
AskAlexSharov
approved these changes
Jul 23, 2026
AskAlexSharov
deleted the
feature/lystopad/zizmor-excessive-perms-packages-21132
branch
July 23, 2026 11:38
pull Bot
pushed a commit
to Dustin4444/erigon
that referenced
this pull request
Jul 23, 2026
…cleanup (erigontech#22694) **Final PR of the zizmor `excessive-permissions` cleanup — closes erigontech#21132** (with erigontech#22688). Follows erigontech#22662, erigontech#22677, erigontech#22687 (and the dead-workflow removal erigontech#22688). ## What 1. **`test-fuzz.yml`** — move `issues: write` from the workflow level to the `notify` job (the only job that opens/updates the `nightly-fuzz` tracking issue). The fuzz matrix job keeps `contents: read`. 2. **`.github/zizmor.yml`** — replace the blanket `excessive-permissions: disable: true` with a per-file `ignore` of just `ci-gate.yml`, and **enable the audit** for every other workflow. ## Why `ci-gate` is ignored rather than scoped `ci-gate` orchestrates the reusable test leaves. Per GitHub's rules, **a called workflow's `GITHUB_TOKEN` permissions are capped by the caller** — so ci-gate's workflow-level grants are not "for itself", they're the ceiling every leaf inherits: - **`actions: write`** is the cap that lets all ~12 self-cancelling leaves (scoped in erigontech#22677/erigontech#22687) actually run `gh run cancel` on merge-queue failure. Dropping it silently breaks fast-cancel and the gate stalls. - **`pull-requests: write`** drives the gate's own `dequeuePullRequest` GraphQL mutation (GitHub doesn't auto-remove UNMERGEABLE queue entries), and is also the cap for sonar's inherited `pull-requests: read`. Neither can be scoped to a single job without adding per-job `permissions` caps to every leaf-call job on the merge gate — high risk for no real privilege gain. The in-file comment documents this, mirrored into the ignore justification. ## Verification - Full repo, real `.github/zizmor.yml`, **with `docker-tags.yml` removed (as erigontech#22688 does)**: `zizmor` → **exit 0, "No findings to report"** (17 ignored, 299 suppressed). - On this branch alone (docker-tags still present until erigontech#22688 merges): exit 13 — one *medium* `docker-tags` finding that erigontech#22688 removes; the gate passes regardless (< 14). - `actionlint` clean; `make lint` = 0 issues. ## Merge order Pairs with **erigontech#22688** (docker-tags removal). Either order is safe (the gate passes both ways); once both land, `excessive-permissions` reports zero findings and **erigontech#21132 can close**. The only remaining zizmor exceptions repo-wide are the deliberate policy ones (`unpinned-uses`, `concurrency-limits`) and the justified per-file ignores (`cache-poisoning`, `secrets-inherit`, and now `excessive-permissions` → ci-gate).
Sahil-4555
pushed a commit
to Sahil-4555/erigon
that referenced
this pull request
Jul 24, 2026
…usable-workflow perms) (erigontech#22714) ## Regression fix — `startup_failure` on main since erigontech#22677 The `excessive-permissions` cleanup (erigontech#22677, erigontech#22687) gave the reusable test leaves explicit permissions (`actions: write` for their merge-queue `gh run cancel`, `pull-requests: read` for sonar). GitHub validates a **called** workflow's declared permissions against the **caller's** grant *at startup* and rejects the whole run if the caller grants less. Callers that only granted `contents: read` therefore began failing to start: | Caller | Calls | Broke at | Effect | |---|---|---|---| | `cache-warming` | lint, sonar, test-bench, test-all-erigon, … | erigontech#22677 | `startup_failure`, **33 checks** dropped | | `sonar-branch-scan` | sonar | erigontech#22677 | `startup_failure`, **1 check** dropped | | `cache-warming-kurtosis-cl-images` | test-kurtosis-assertoor | erigontech#22687 | `startup_failure` | Both cache-warming and sonar-branch-scan went `success` → `startup_failure` exactly at commit `6f7557ebec` (erigontech#22677) and have failed on **every main commit since** — silently dropping ~34 checks per commit (this is the "134 → 99" drop visible in main's commit history). `ci-gate` was unaffected because it already grants `actions: write` + `pull-requests: write`; `cache-warming-kurtosis-gloas-images` is unaffected because its leaf (`test-kurtosis-gloas`) was never modified and still declares only `contents: read` — a clean control confirming the mechanism. ## Fix Grant each broken caller the union of its leaves' declared permissions: - `cache-warming` → `contents: read`, `actions: write`, `pull-requests: read` - `sonar-branch-scan` → `contents: read`, `actions: write`, `pull-requests: read` - `cache-warming-kurtosis-cl-images` → `contents: read`, `actions: write` These callers are orchestrators that must grant the leaf permission cap workflow-wide (exactly like `ci-gate`), so they're added to the `excessive-permissions` ignore list with a generalized justification. ## Verification - `zizmor` (real `.github/zizmor.yml`, audit enabled): **exit 0, "No findings to report."** - `actionlint` clean on the diff (the pre-existing `concurrency.queue` note is unrelated). - `make lint` = 0 issues. - Post-merge confirmation: the push-triggered `Cache Warming` and `SonarCloud Branch Scan` runs on main should return to `success` (from `startup_failure`). ## Note / lesson Root cause was mine: when adding the leaves' `permissions:` in erigontech#22677/erigontech#22687 I didn't account for GitHub's caller-must-grant rule for reusable workflows, so non-ci-gate callers broke. This restores them without weakening the least-privilege scoping. --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of the zizmor
excessive-permissionscleanup (#21132). Follow-up to #22662 and #22677.What
Adds explicit least-privilege
permissions:blocks to 5 workflows that were running on the broad default token:ci-cd-main-branch-docker-imagescontents: readqa-txpool-performance-testcontents: readtest-hivecontents: read+actions: writegh run canceltest-hive-eestcontents: read+actions: writegh run canceltest-kurtosis-assertoorcontents: read;actions: writeonassertoor_testonlygh run cancelNotes
test-kurtosis-assertoorbuilds the erigon image withload: true(no registry push), so nopackages: writeis required;actions: writeis scoped to the single job that self-cancels rather than the workflow level (which would trip "overly broad").Verification
excessive-permissions: 12 → 3 for these files (the remaining 3 areci-gate/test-fuzz, handled next).actionlintclean w.r.t. this change (only pre-existing shellcheck notes remain);make lint= 0 issues.Rollout note
The audit stays
disable: truein.github/zizmor.ymluntil the series finishes; the final PR flips it on so the gate enforces it.