Skip to content

ci: add explicit permissions to workflow jobs#2388

Open
yonib05 wants to merge 1 commit into
strands-agents:mainfrom
yonib05:fix/workflow-permissions-and-deps
Open

ci: add explicit permissions to workflow jobs#2388
yonib05 wants to merge 1 commit into
strands-agents:mainfrom
yonib05:fix/workflow-permissions-and-deps

Conversation

@yonib05

@yonib05 yonib05 commented May 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Summary

  • Add permissions: {} to ci-gate job in ci.yml (uses no token, so empty permissions is correct)
  • Add permissions: { contents: read, issues: write } to check-links job in python-check-markdown-links.yml

Test plan

  • Verify CI workflow still passes (ci-gate job uses no token)
  • Verify markdown link checker still works with the declared permissions

@yonib05 yonib05 force-pushed the fix/workflow-permissions-and-deps branch from a2984c1 to 2d74cb8 Compare May 29, 2026 18:31
@github-actions github-actions Bot added size/xl and removed size/xl labels May 29, 2026
@github-actions

github-actions Bot commented May 29, 2026

Copy link
Copy Markdown
Contributor

Assessment: Approve

Clean and well-scoped security hardening PR. The workflow permission declarations follow the principle of least privilege correctly (permissions: {} for ci-gate which needs no token, and contents: read + issues: write for the link checker which needs exactly those). The aws-cdk-lib bump is consistent across all four CDK examples and resolves documented transitive vulnerabilities.

Review Notes
  • Workflow Permissions: Both additions are correct and minimal — no over-provisioning.
  • Dependency Updates: The aws-cdk-lib 2.192.0 → 2.257.0 bump is a minor-version update within CDK v2, low risk for example projects. Lock file churn accounts for virtually all the line count.
  • Scope: No production code or API changes — purely CI/infrastructure.

Straightforward security improvement — LGTM.

@codecov

codecov Bot commented May 29, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

zastrowm
zastrowm previously approved these changes May 29, 2026
View reviewed changes
@github-actions

github-actions Bot commented May 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Documentation Preview Ready

Your documentation preview has been successfully deployed!

Preview URL: https://d3ehv1nix5p99z.cloudfront.net/pr-cms-2388/docs/user-guide/quickstart/overview/

Updated at: 2026-06-05T20:11:17.400Z

@yonib05 yonib05 force-pushed the fix/workflow-permissions-and-deps branch from 2d74cb8 to dbd2952 Compare June 1, 2026 16:58
@github-actions github-actions Bot removed the size/xl label Jun 1, 2026
@yonib05
ci: add explicit permissions to workflow jobs
6a7faed 
- Add permissions: {} to ci-gate job (needs no token access)
- Add permissions: contents: read, issues: write to
  check-links job (reads repo, may create issues)
@yonib05 yonib05 force-pushed the fix/workflow-permissions-and-deps branch from dbd2952 to 831bd02 Compare June 5, 2026 20:06
@github-actions github-actions Bot added size/xl and removed size/xl labels Jun 5, 2026
@yonib05 yonib05 force-pushed the fix/workflow-permissions-and-deps branch from 831bd02 to 6a7faed Compare June 5, 2026 20:08
@github-actions github-actions Bot added size/xs and removed size/xl labels Jun 5, 2026
@github-actions

github-actions Bot commented Jun 5, 2026

Copy link
Copy Markdown
Contributor

Assessment: Approve

Clean security-hardening PR. The workflow permission additions follow the principle of least privilege correctly, and the lock file regenerations resolve documented transitive dependency vulnerabilities.

Review Notes
  • Workflow Permissions: permissions: {} for ci-gate is correct (no token needed for re-actors/alls-green). contents: read + issues: write for check-links matches exactly what the job requires (checkout + issue creation).
  • Lock Files: All changes are lock file churn from the aws-cdk-lib bump and qs advisory resolution — no production code or API surface affected.
  • Scope: Appropriately scoped to CI/infrastructure only.

@github-actions

github-actions Bot commented Jun 5, 2026

Copy link
Copy Markdown
Contributor

Assessment: Approve

Straightforward security hardening — both permission declarations are minimal and correct for their respective jobs.

Verification
  • ci-gate → permissions: {}: Job only runs re-actors/alls-green to aggregate other job statuses; no checkout, no token usage — empty permissions is the right call.
  • check-links → contents: read + issues: write: Exactly what's needed for actions/checkout and the github.rest.issues.create() / listForRepo() calls in the script.

@yonib05 yonib05 changed the title ci: add workflow permissions and update vulnerable dependencies ci: add explicit permissions to workflow jobs Jun 5, 2026
zastrowm
zastrowm reviewed Jun 8, 2026
View reviewed changes
Comment thread .github/workflows/python-check-markdown-links.yml
@@ -8,6 +8,9 @@ on:
jobs:
check-links:

@zastrowm zastrowm Jun 8, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this actually work? I didn't even know this was a workflow we maintained

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@zastrowm zastrowm zastrowm approved these changes

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

size/xs

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@yonib05 @zastrowm