Skip to content

PDP-1182 SECCMP-1797: Add top-level permissions to restrict default token #1070

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rjrudin merged 2 commits into from
Apr 8, 2026
Merged

PDP-1182 SECCMP-1797: Add top-level permissions to restrict default token #1070

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4d46d57
Merge pull request #1063 from marklogic/release/4.1.0
stevebio Feb 20, 2026
00fc4eb
SECCMP-1797: Add top-level permissions to restrict default token
GAdityaVarma Apr 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions .github/workflows/pr-workflow.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,18 +1,17 @@
name: PR Workflow

on:
Copy link

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The rationale for using pull_request_target (especially for fork PRs) was removed. Since this event has important security implications, consider keeping a brief comment explaining why pull_request_target is required here and what safeguards are assumed (e.g., no checkout of untrusted code).

Suggested change
on:
on:
# Use pull_request_target so these checks can run for fork PRs in the base
# repository context. This workflow is expected to remain metadata-only:
# it should not check out or execute untrusted PR code, and should only
# pass PR metadata to trusted reusable workflows.

Copilot uses AI. Check for mistakes.
# Using pull_request_target instead of pull_request to handle PRs from forks
pull_request_target:
types: [opened, edited, reopened, synchronize]
# No branch filtering - will run on all PRs

permissions:
contents: read

jobs:
jira-pr-check:
name: 🏷️ Validate JIRA ticket ID
# Use the reusable workflow from the central repository
uses: marklogic/pr-workflows/.github/workflows/jira-id-check.yml@main
Copy link

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reusable workflows are referenced by a mutable branch (@main) here (and also in the copyright-validation job below). For supply-chain security—especially with pull_request_target—pin reusable workflows to a specific commit SHA or a trusted, immutable tag to prevent unexpected upstream changes being pulled into this workflow.

Copilot uses AI. Check for mistakes.
with:
# Pass the PR title from the event context
pr-title: ${{ github.event.pull_request.title }}
copyright-validation:
name: © Validate Copyright Headers
Expand Down
Loading