Security / Public reference

Workflow permissions are broad

A GitHub Actions workflow whose permissions value is write-all, or a pull_request_target workflow that sets contents: write.

What you need to supply

The workflow YAML. The check does not change the workflow.

If it reports a finding

High severity. The suggested next step is to set the narrowest permissions the workflow needs and keep contents read-only on pull_request_target.

What this does not prove

A multi-line permissions block is still this finding when it grants write-all or contents: write on pull_request_target. The safe edit only replaces an exact permissions: write-all line.

Permissions line that this check is written to notice

permissions: write-all

Proposed change

When this line appears once, the review proposes this change.

permissions: write-all becomes permissions: contents: read

All review checks. Reading this page does not submit your infrastructure.