Baike.dev
Log in
Back to tool/Back to issues
#4036·vcluster

Backport workflow-hardening fix (excessive-permissions) to 5 release branches

Author: CharlieMCYCreated Jun 26, 2026Updated Jun 26, 2026

Summary

The default branch already hardened .github/workflows/e2e.yaml against the issue(s) below, but 5 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

What's flagged (by zizmor)

  • excessive-permissions — workflow/job granted broader permissions than needed

Already resolved on the default branch in:

Affected release branches (5)

  • v0.27 (still present as of HEAD eb70c350)
  • v0.23 (still present as of HEAD 714a1808)
  • v0.26 (still present as of HEAD ba80d52b)
  • v0.24 (still present as of HEAD 8912c550)
  • v0.25 (still present as of HEAD 786c7160)

Suggested per-branch patches

Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

v0.27 — excessive-permissions

File .github/workflows/e2e.yaml; suggested edits:

    • jobs.$J.permissions.contents = 'read'
    • jobs.$J.permissions.id-token = 'write'
diff
--- a/.github/workflows/e2e.yaml
+++ b/.github/workflows/e2e.yaml
@@ -431,3 +431,6 @@
           echo "======================================================================================================================"
           kubectl describe pods -n ${{ env.VCLUSTER_NAMESPACE }}
           exit 1
+    permissions:
+      contents: read
+      id-token: write
v0.23 — excessive-permissions

File .github/workflows/e2e.yaml; suggested edits:

    • jobs.$J.permissions.contents = 'read'
    • jobs.$J.permissions.id-token = 'write'
diff
--- a/.github/workflows/e2e.yaml
+++ b/.github/workflows/e2e.yaml
@@ -501,3 +501,6 @@
           echo "======================================================================================================================"
           kubectl describe pods -n ${{ env.VCLUSTER_NAMESPACE }}
           exit 1
+    permissions:
+      contents: read
+      id-token: write
v0.26 — excessive-permissions

File .github/workflows/e2e.yaml; suggested edits:

    • jobs.$J.permissions.contents = 'read'
    • jobs.$J.permissions.id-token = 'write'
diff
--- a/.github/workflows/e2e.yaml
+++ b/.github/workflows/e2e.yaml
@@ -429,3 +429,6 @@
           echo "======================================================================================================================"
           kubectl describe pods -n ${{ env.VCLUSTER_NAMESPACE }}
           exit 1
+    permissions:
+      contents: read
+      id-token: write
v0.24 — excessive-permissions

File .github/workflows/e2e.yaml; suggested edits:

    • jobs.$J.permissions.contents = 'read'
    • jobs.$J.permissions.id-token = 'write'
diff
--- a/.github/workflows/e2e.yaml
+++ b/.github/workflows/e2e.yaml
@@ -501,3 +501,6 @@
           echo "======================================================================================================================"
           kubectl describe pods -n ${{ env.VCLUSTER_NAMESPACE }}
           exit 1
+    permissions:
+      contents: read
+      id-token: write
v0.25 — excessive-permissions

File .github/workflows/e2e.yaml; suggested edits:

    • jobs.$J.permissions.contents = 'read'
    • jobs.$J.permissions.id-token = 'write'
diff
--- a/.github/workflows/e2e.yaml
+++ b/.github/workflows/e2e.yaml
@@ -434,3 +434,6 @@
           echo "======================================================================================================================"
           kubectl describe pods -n ${{ env.VCLUSTER_NAMESPACE }}
           exit 1
+    permissions:
+      contents: read
+      id-token: write

Happy to open pull requests instead if that's preferred.

Source: loft-sh/vcluster

View original on GitHubView discussion on GitHub