Skip to content

Harden sync-team-access workflow template (explicit perms + secrets)#98

Merged
dkastl merged 1 commit into
mainfrom
chore/harden-sync-team-access-template
Jul 20, 2026
Merged

Harden sync-team-access workflow template (explicit perms + secrets)#98
dkastl merged 1 commit into
mainfrom
chore/harden-sync-team-access-template

Conversation

@dkastl

@dkastl dkastl commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

What

Harden workflow-templates/sync-team-access.yml to match the already-hardened route-issue.yml template:

  • add a permissions: contents: read ceiling, and
  • pass the OPS_DISPATCH_CLIENT_ID / OPS_DISPATCH_APP_PRIVATE_KEY dispatch secrets explicitly instead of secrets: inherit.

Why

sync-team-access.yml was the last picker template still using secrets: inherit with no permissions: block, so any repo adopting it from the "New workflow" picker inherited two zizmor findings on first commit:

  • excessive-permissions (default token, no permissions: block)
  • secrets-inherit (all secrets forwarded unconditionally)

The reusable declares exactly these two secrets (reusable-sync-team-access.yml -> on.workflow_call.secrets) and needs no more than contents: read at the caller (it dispatches via an App token), so the explicit form is a drop-in.

Surfaced while adopting the Security Suite in geolonia-design-system, where the same fix was applied to that repo's copy.

Note

Reusable pin left at its current v1.16.0 (unchanged); this PR is scoped to the hardening only.

Match the already-hardened route-issue.yml template: add a contents: read
ceiling and pass the OPS_DISPATCH_* dispatch secrets explicitly instead of
secrets: inherit. Clears zizmor excessive-permissions and secrets-inherit for
every repo that adopts this template from the New workflow picker.
@coderabbitai

coderabbitai Bot commented Jul 20, 2026

Copy link
Copy Markdown

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 29 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: db5d63bd-aaf1-4176-83ed-e7d34c2b0919

📥 Commits

Reviewing files that changed from the base of the PR and between 6793909 and bd46195.

📒 Files selected for processing (1)
  • workflow-templates/sync-team-access.yml
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch chore/harden-sync-team-access-template

Comment @coderabbitai help to get the list of available commands.

@github-actions

Copy link
Copy Markdown
Contributor

🛡️ Security suite

Check Result
✅ Supply chain · bumblebee No exposure matches
✅ Secrets · betterleaks No secrets in diff
✅ Action pinning · pinact All actions pinned
✅ Actions audit · zizmor No findings

Note

All security checks passed.

Updated for bd46195 · workflow run

@dkastl
dkastl marked this pull request as ready for review July 20, 2026 23:14
@dkastl
dkastl requested a review from Copilot July 20, 2026 23:15

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens the sync-team-access workflow template by aligning it with other hardened templates in this repo, eliminating common zizmor findings for repos that adopt it via the workflow picker.

Changes:

  • Add an explicit workflow token permission ceiling (permissions: contents: read) to avoid repo-default token permissions.
  • Replace secrets: inherit with an explicit secrets mapping for only OPS_DISPATCH_CLIENT_ID and OPS_DISPATCH_APP_PRIVATE_KEY.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@dkastl
dkastl merged commit abd473b into main Jul 20, 2026
6 of 7 checks passed
@dkastl
dkastl deleted the chore/harden-sync-team-access-template branch July 20, 2026 23:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants