Repository navigation
ci(security): propagate least-privilege tokens to docouture workflows - #298
Conversation
Adopts the hardened docouture workflow set from InditexTech/internal-ops#768: workflow-level permissions {}, job permissions limited to what each job needs, gh-pages/tag pushes via an App token narrowed to this repository with contents: write, APP_PRIVATE_KEY passed explicitly to docouture-publish.yml instead of secrets: inherit, no dependency or Kroki image caches on the lanes that publish, and no third-party path filter (plain git diff instead). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned Files
|
❗ This Pull Request will not trigger a docs releaseA Pull Request with no |
|
|
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
The six workflows consistently implement the stated least-privilege model without identified functional regressions.
Review effort: Balanced
Findings: None
What changed in this PR
Hardens Docouture workflows with least-privilege authentication and safer publishing behavior.
Changes:
- Uses job-scoped permissions and repository-scoped GitHub App tokens for writes.
- Disables credential persistence and publishing caches.
- Replaces third-party path filtering and prevents prereleases from moving stable documentation tags.
| File | Description |
|---|---|
.github/workflows/docouture-release.yml |
Secures release tagging, version bumps, and reusable publishing. |
.github/workflows/docouture-release-preview.yml |
Uses scoped API access for path checks, tag lookup, and comments. |
.github/workflows/docouture-publish.yml |
Publishes using an explicitly passed, scoped App credential. |
.github/workflows/docouture-publish-prerelease.yml |
Replaces path filtering with a local diff and scopes permissions. |
.github/workflows/docouture-pr-verify.yml |
Applies job-level read access and disables persisted credentials. |
.github/workflows/docouture-kroki-cache-warm.yml |
Restricts permissions and safely handles Docker image arguments. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Resumen
Propaga a este repo el hardening de los workflows
docouture-*ya validado en InditexTech/internal-ops#768 (y aplicado en InditexTech/cerbia#20): resuelve los alertos Scorecard Token-Permissions heredados del scaffold (contents: writetop-level / job-level sin acotar).Qué cambia (los 6 workflows)
permissions: {}a nivel de workflow; permisos por job limitados a lo que cada job necesita (contents: read,pull-requests: writesolo en los jobs que comentan).gh-pages, tagsdocs/*y el bump dedocs/.release-versionautentican con el App token ya existente, ahora acotado (owner/repositories/permission-contents: write);GITHUB_TOKENqueda read-only ypersist-credentials: false.APP_PRIVATE_KEYpasa al reusable como secret explícito (nada desecrets: inherit).dorny/paths-filterpor un diff git local.releaseya no dispara con pre-releases de código y el guard de ref usaenv(sin template injection).Nota: el sitio de docs de este repo no tiene Kroki activado, así que el pull en frío no afecta.
Verificación
zizmor1.29.0 sobre los 6: 0 hallazgos.