BacLuc / ecamp3 / 34639069144

37%

devel: 37%

Pull #343

github

ci(security): add explicit minimal permissions blocks to e2e workflow files

Add top-level permissions: blocks to the three e2e workflow files that
currently rely on default GITHUB_TOKEN permissions, following the
principle of least privilege:

- e2e-tests-all.yml: workflow-level contents: read; job-level
  contents: read + actions: write on the two jobs that call the reusable
  workflows (a called workflow can only downgrade, never elevate, the
  caller's token, so the calling jobs must grant actions: write)
- reusable-e2e-tests-build.yml: contents: read + actions: write
  (checkout, docker build with GHA cache, upload-artifact)
- reusable-e2e-tests-run.yml: contents: read + actions: write
  (checkout, download/upload/cache artifact, delete-artifact)

This resolves the zizmor 'overly broad permissions' (excessive-permissions)
finding for e2e-tests-all.yml.

Related: bacluc-agent/agent-todo#154
Implements: ecamp/ecamp3#9971

878 of 4707 branches covered (18.65%)

Branch coverage included in aggregate %.

4937 of 10994 relevant lines covered (44.91%)

63.17 hits per line