From ee47a2185173bfd0aaa17f2670ad23f54bb08eb4 Mon Sep 17 00:00:00 2001 From: jesusph04 Date: Mon, 3 Aug 2026 14:17:17 +0200 Subject: [PATCH 1/2] Add explicit permissions to 4.x workflows --- .github/workflows/4_build_and_push_images.yml | 4 ++++ .github/workflows/4_pr_check.yml | 3 +++ CHANGELOG.md | 2 +- 3 files changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/4_build_and_push_images.yml b/.github/workflows/4_build_and_push_images.yml index e60a00f7..6eea071c 100644 --- a/.github/workflows/4_build_and_push_images.yml +++ b/.github/workflows/4_build_and_push_images.yml @@ -213,6 +213,10 @@ jobs: notify: runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }} + + permissions: + contents: read + needs: [setup, build-and-push] # Only run if NOT dev AND all products were selected if: ${{ inputs.dev == false && needs.setup.outputs.ALL_PRODUCTS_SELECTED == 'true' }} diff --git a/.github/workflows/4_pr_check.yml b/.github/workflows/4_pr_check.yml index e5a11083..467953c1 100644 --- a/.github/workflows/4_pr_check.yml +++ b/.github/workflows/4_pr_check.yml @@ -12,6 +12,9 @@ on: - 'wazuh-agent/**' - '.github/**' +permissions: + contents: read + env: ARTIFACTS_LOCAL_DIR: /home/runner/work/wazuh-docker/wazuh-docker/docker-images ARTIFACT_NAMES: | diff --git a/CHANGELOG.md b/CHANGELOG.md index 1ce00aa0..7068b4e1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,7 +9,7 @@ | Issue | Comment | | - | - | - +- Added explicit `permissions` blocks to the 4.x workflows to restrict the `GITHUB_TOKEN` scope ([#2461](https://github.com/wazuh/wazuh-docker/issues/2461)) ### Removed | Issue | Comment | From 245fba32a929c5825b7758f339c6457b134e5421 Mon Sep 17 00:00:00 2001 From: jesusph04 Date: Tue, 4 Aug 2026 13:04:24 +0200 Subject: [PATCH 2/2] Fix CHANGELOG format and remove trailing whitespace --- .github/workflows/4_build_and_push_images.yml | 4 ++-- .github/workflows/4_pr_check.yml | 2 +- CHANGELOG.md | 3 ++- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/.github/workflows/4_build_and_push_images.yml b/.github/workflows/4_build_and_push_images.yml index 6eea071c..8fe096ac 100644 --- a/.github/workflows/4_build_and_push_images.yml +++ b/.github/workflows/4_build_and_push_images.yml @@ -213,10 +213,10 @@ jobs: notify: runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }} - + permissions: contents: read - + needs: [setup, build-and-push] # Only run if NOT dev AND all products were selected if: ${{ inputs.dev == false && needs.setup.outputs.ALL_PRODUCTS_SELECTED == 'true' }} diff --git a/.github/workflows/4_pr_check.yml b/.github/workflows/4_pr_check.yml index 467953c1..d1977acf 100644 --- a/.github/workflows/4_pr_check.yml +++ b/.github/workflows/4_pr_check.yml @@ -14,7 +14,7 @@ on: permissions: contents: read - + env: ARTIFACTS_LOCAL_DIR: /home/runner/work/wazuh-docker/wazuh-docker/docker-images ARTIFACT_NAMES: | diff --git a/CHANGELOG.md b/CHANGELOG.md index 7068b4e1..bb3f7f6b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,7 +9,8 @@ | Issue | Comment | | - | - | -- Added explicit `permissions` blocks to the 4.x workflows to restrict the `GITHUB_TOKEN` scope ([#2461](https://github.com/wazuh/wazuh-docker/issues/2461)) +| [#2461](https://github.com/wazuh/wazuh-docker/issues/2461) | Added explicit `permissions` blocks to the 4.x workflows to restrict the `GITHUB_TOKEN` scope | + ### Removed | Issue | Comment |