Conversation
intellikit-ci-test.yml declares permissions: contents: read; intellikit-pytest.yml declares nothing and so inherits the repository default, which is write. The two workflows do the same kind of work and should not differ in what they hand their jobs. Safe for this workflow: it checks out the repo and builds an Apptainer image locally. No registry login, no secrets, no artifact upload, nothing that writes back to GitHub. The `packages:` line is a job output name, not a permission. ci-test.yml already runs the same container build under contents: read. This does not change fork-PR behaviour -- GitHub already forces a read-only token and withholds secrets for pull_request from a fork regardless of the repository default. It closes the gap for pushes and same-repo pull requests, where the default does apply. Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The two GPU workflows disagree about what they hand their jobs:
permissions:intellikit-ci-test.ymlcontents: readintellikit-pytest.ymlThey do the same kind of work, so this makes
intellikit-pytest.ymlmatch.Why it is safe
intellikit-pytest.ymlchecks out the repo and builds an Apptainer image locally. Nodocker/login, no registry, nosecrets.*, noupload-artifact— nothing that writes back to GitHub. Thepackages:line is a job output name, not a permission. Andintellikit-ci-test.ymlalready runs the samecontainer_build.shundercontents: read, so the configuration is proven by its sibling rather than by argument.What it does not do
It does not change fork-PR behaviour. GitHub already forces a read-only token and withholds secrets for
pull_requestfrom a fork, regardless ofdefault_workflow_permissions. This closes the gap for pushes and same-repo pull requests, where the repository default does apply.Found while reviewing the self-hosted runner exposure. Worth having independently of that.