Repository navigation
ci(security): propagate least-privilege tokens to docouture workflows - #177
Merged
Merged
Conversation
Adopts the hardened docouture workflow set from InditexTech/internal-ops#768: workflow-level permissions {}, job permissions limited to what each job needs, gh-pages/tag pushes via an App token narrowed to this repository with contents: write, APP_PRIVATE_KEY passed explicitly to docouture-publish.yml instead of secrets: inherit, and no dependency or Kroki image caches on the lanes that publish (cache poisoning vector for anything that ships). Kroki pulls cold on those lanes; kroki-enabled is true here, so expect a slower first build per release. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
ivanasabi
force-pushed
the
fix/propagate-workflow-hardening
branch
from
October 5, 2026 10:19
3e8a494 to
21d0de2
Compare
…w-hardening # Conflicts: # .github/workflows/docouture-release.yml
Contributor
❗ This Pull Request will not trigger a docs releaseA Pull Request with no |
Contributor
❌ No changes in
|
Contributor
❗ This Pull Request will not trigger a docs releaseA Pull Request with no |
Contributor
Release PreviewAdd a |
This was referenced Oct 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resumen
Propaga a este repo el hardening de los workflows
docouture-*ya validado en InditexTech/internal-ops#768 (y aplicado en InditexTech/cerbia#20): sustituye la mitigación parcial actual (top-levelcontents: readmanteniendocontents: writepor job) por el esquema completo.Qué cambia (los 6 workflows)
permissions: {}a nivel de workflow; permisos por job limitados a lo que cada job necesita (contents: read,pull-requests: writesolo en los jobs que comentan).gh-pages, tagsdocs/*y el bump dedocs/.release-versionautentican con un App token acotado (owner/repositories/permission-contents: write);GITHUB_TOKENqueda read-only ypersist-credentials: false.APP_PRIVATE_KEYpasa al reusable como secret explícito (nada desecrets: inherit).docouture-kroki-cache-warmsigue calentando la cache parapr-verify).dorny/paths-filterpor un diff git local.releaseya no dispara con pre-releases de código y el guard de ref usaenv(sin template injection).Verificación
zizmor1.29.0 sobre los 6: 0 hallazgos.