From 941101b65eae7becbf10865332d52331b51f89a8 Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Wed, 22 Jul 2026 16:53:14 +0500 Subject: [PATCH] ci: drop unused packages:write from the pull-request workflow The build, build-talos and finalize jobs each requested `packages: write`, but none of them writes to GHCR. They authenticate to OCIR with OCIR_USER/OCIR_TOKEN and push to REGISTRY, which the workflow sets to OCIR. The only GHCR login in the file is in verify-release-candidate, and that job holds `packages: read`. GHCR pushes elsewhere in CI authenticate with GITHUB_TOKEN plus packages:write rather than a stored secret, so on those paths the scope is the whole credential. Granting it on the pull_request lane hands every same-repo PR run a token with GHCR write authority that the lane has no use for. Whether a package honours that write depends on its Actions access setting, which lives outside this repo, so this is least-privilege hygiene rather than a fix for a demonstrated exploit. Assisted-by: LLM Signed-off-by: Myasnikov Daniil --- .github/workflows/pull-requests.yaml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/pull-requests.yaml b/.github/workflows/pull-requests.yaml index ca7e9bc5a..6205dcb26 100644 --- a/.github/workflows/pull-requests.yaml +++ b/.github/workflows/pull-requests.yaml @@ -348,7 +348,6 @@ jobs: timeout-minutes: 30 permissions: contents: read - packages: write strategy: fail-fast: false matrix: @@ -492,7 +491,6 @@ jobs: timeout-minutes: 40 permissions: contents: read - packages: write steps: - name: Checkout code uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 @@ -583,7 +581,6 @@ jobs: timeout-minutes: 30 permissions: contents: read - packages: write steps: - name: Checkout code uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4