From af2ab331956bc2aba3b549ecd5ca5965d7bfeaee Mon Sep 17 00:00:00 2001 From: Erik Schaareman Date: Sun, 19 Apr 2026 22:05:33 +0200 Subject: [PATCH 1/3] fix(ci): add explicit workflow permissions --- .github/workflows/qa.yml | 4 ++++ .github/workflows/release.yml | 7 +++++-- .github/workflows/security.yml | 5 +++++ .github/workflows/verify.yml | 4 ++++ 4 files changed, 18 insertions(+), 2 deletions(-) diff --git a/.github/workflows/qa.yml b/.github/workflows/qa.yml index 6776d4b..e4f73d9 100644 --- a/.github/workflows/qa.yml +++ b/.github/workflows/qa.yml @@ -8,6 +8,10 @@ on: push: branches-ignore: [main] +permissions: + # Workflow only needs read access to repository contents. + contents: read + env: PYTHON_VERSION: "3.11" POETRY_VIRTUALENVS_IN_PROJECT: "true" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2e754d7..0a63d4e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -9,8 +9,8 @@ on: branches: [main] permissions: - # Needed for creating tags and GitHub releases. - contents: write + # Default to read-only; release job elevates to write for tagging/releases. + contents: read env: # Shared interpreter version for build and metadata steps. @@ -23,6 +23,9 @@ jobs: # Computes semantic version, creates git tag, and publishes GitHub release. name: Compute Version and Tag runs-on: ubuntu-latest + permissions: + # Needed for creating tags and GitHub releases. + contents: write # Guard: run only for merged PRs. if: github.event.pull_request.merged == true outputs: diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 072349b..e83d434 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -7,6 +7,11 @@ on: pull_request: branches: [main] +permissions: + # Required by checkout and PR-context scanners. + contents: read + pull-requests: read + env: # Keep scanner runtime consistent across runs. PYTHON_VERSION: "3.11" diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml index f9a0594..914977b 100644 --- a/.github/workflows/verify.yml +++ b/.github/workflows/verify.yml @@ -7,6 +7,10 @@ name: Verify pull_request: branches: [main] +permissions: + # Verify jobs only read repository contents. + contents: read + env: # Shared interpreter version for reproducible CI behavior. PYTHON_VERSION: "3.11" From ac886ef301724cf957589f3d9673c0f212c444c0 Mon Sep 17 00:00:00 2001 From: Erik Schaareman Date: Sun, 19 Apr 2026 22:07:49 +0200 Subject: [PATCH 2/3] docs(changelog): record workflow permissions fix --- .github/workflows/verify.yml | 2 +- CHANGELOG.md | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml index 914977b..ab8ab04 100644 --- a/.github/workflows/verify.yml +++ b/.github/workflows/verify.yml @@ -2,7 +2,7 @@ # Purpose: validate both source tests and generated/installable artifacts. name: Verify -"on": +on: # Run on PRs targeting main so merge decisions are based on full verification. pull_request: branches: [main] diff --git a/CHANGELOG.md b/CHANGELOG.md index c6f4f77..46678d3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -26,6 +26,8 @@ Skill expansion and documentation alignment update. - `README.md` role–skill table updated to reflect new primary skills per role. - `README.md` project structure diagram updated to include `instructions/` and `prompts/` template directories and the correct `docs/` subdirectory layout. - `.github/copilot-instructions.md` updated: system structure diagram now includes all four template artifact types (`skills`, `agents`, `instructions`, `prompts`); hand-authored `.github/` exceptions listed explicitly; install table extended with `instructions` and `prompts` rows. +- GitHub Actions workflows now declare explicit `permissions` with least-privilege defaults; release write access is scoped to the release job only. +- `verify.yml` normalized to use `on:` (unquoted) for style consistency with other workflows. ## 1.0.3 — 2026-04-19 From da5461bdcb37a879b43ba4b4a36216efd5a901e2 Mon Sep 17 00:00:00 2001 From: Erik Schaareman Date: Sun, 19 Apr 2026 22:09:32 +0200 Subject: [PATCH 3/3] chore(vstack): refresh install manifest --- .github/vstack.json | 2 +- CHANGELOG.md | 19 ++++++++++++++++--- 2 files changed, 17 insertions(+), 4 deletions(-) diff --git a/.github/vstack.json b/.github/vstack.json index 9dc7425..77ae811 100644 --- a/.github/vstack.json +++ b/.github/vstack.json @@ -1,6 +1,6 @@ { "vstack_version": "0.0.0.post3.dev0+df3fe6e", - "installed_at": "2026-04-19T19:50:07.239266+00:00", + "installed_at": "2026-04-19T20:09:26.508121+00:00", "artifacts": { "skills": [ { diff --git a/CHANGELOG.md b/CHANGELOG.md index 46678d3..300290b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,21 @@ # Changelog -## [Unreleased] — 1.0.4 +## 1.0.5 — 2026-04-19 + +Workflow hardening and release-manifest refresh. + +### Fixed in 1.0.5 + +- GitHub Actions workflows now declare explicit `permissions` to satisfy policy checks and follow least-privilege defaults. + +### Changed in 1.0.5 + +- `release.yml` now defaults to read-only workflow permissions and scopes `contents: write` to the `version-and-release` job only. +- `qa.yml`, `security.yml`, and `verify.yml` now declare explicit workflow-level `permissions`. +- `verify.yml` normalized to use `on:` (unquoted) for style consistency with other workflows. +- `.github/vstack.json` refreshed via install to record the latest generated artifact manifest metadata. + +## 1.0.4 — 2026-04-19 Skill expansion and documentation alignment update. @@ -26,8 +41,6 @@ Skill expansion and documentation alignment update. - `README.md` role–skill table updated to reflect new primary skills per role. - `README.md` project structure diagram updated to include `instructions/` and `prompts/` template directories and the correct `docs/` subdirectory layout. - `.github/copilot-instructions.md` updated: system structure diagram now includes all four template artifact types (`skills`, `agents`, `instructions`, `prompts`); hand-authored `.github/` exceptions listed explicitly; install table extended with `instructions` and `prompts` rows. -- GitHub Actions workflows now declare explicit `permissions` with least-privilege defaults; release write access is scoped to the release job only. -- `verify.yml` normalized to use `on:` (unquoted) for style consistency with other workflows. ## 1.0.3 — 2026-04-19